How to enforce password complexity in O365?

As organizations continue migrating data and services to the cloud, management and enforcement of strong password policies has never been more important.

When it comes to Office 365 cloud-only users (not synchronized with a corresponding to an Active Directory account) the configurable options are quite limited:

Office 365 cloud-only users are subject to the hard-coded password policy built into Azure AD. Per Microsoft, the requirements are as follows:

Microsoft has recently launched Azure AD Password Protection, which adds dictionary capabilities to passwords for customers with an Azure AD Premium subscription. There are two layers to the Microsoft solution:

• Global Banned Password List – a Microsoft-provided list of “commonly used and compromised passwords.” Microsoft does not disclose any details about the contents of this list – there is, by design, no information on what sources Microsoft has used to compile the list, nor any details about its size.
• Custom banned Password List – available with an Azure AD Premium P1 or P2 subscription, customers can block a custom list of words from appearing in user passwords.

Microsoft also has support for extending the Password Protection feature to your on-premise Active Directory. Key limitations there include:

• As with all other Azure AD policies, it is a global setting (cannot target specific users/groups/OUs).
• Users do not get any feedback as to why their on-premise password was rejected during Ctrl+Alt+Del password changes on their laptops.

In order to get better control over your Active Directory and Office 365 passwords, administrators should look to 3^rd party solutions. These solutions will need to leverage the on-premises Active Directory along with synchronizing or federating Office 365 password authentication, as Microsoft also does not support 3^rd party password solutions for cloud-only Office 365 users.

With such solutions, you can achieve extremely granular control over both the scope and requirements of your password policies for both on-prem AD and Office 365 authentication.