I'm looking for a way to change the settings for Password protection in azure via powershell/graph api/azure cli. The settings I'm looking to change can be found in Azure AD -> Security -> Authentication methods -> Password protection.

Possibility of setting Password protection settings in azure AD via graph api/powershell

Accepted answer

Vasil Michev 95,181 MVP

Those settings are managed via the so-called "directory settings/templates". To manage them via PowerShell, use the preview module (AzureADPreview) and the Get-AzureADDirectorySettingTemplate/New-AzureADDirectorySetting cmdlet.

Via Graph: https://learn.microsoft.com/en-us/graph/api/directorysetting-post-settings?view=graph-rest-beta&tabs=http

Ole Friis Nielsen 111

Thank you for the answer, I got it working by using the following commands (Attached so others who find this thread can use them in the future):

$BannedPasswords = "apple`tbanana" # List of banned passwords, must use `t instead of enter or space

$CurrentSettings = Get-AzureADDirectorySetting
if ($CurrentSettings | Where-Object {$_.DisplayName -eq "Password Rule Settings"}) {
    Remove-AzureADDirectorySetting -Id $CurrentSettings.Id
}
$NewSetting = (Get-AzureADDirectorySettingTemplate | Where-Object {$_.DisplayName -eq "Password Rule Settings"}).CreateDirectorySetting()

$NewSetting.Values = @(@{
    Name = "BannedPasswordCheckOnPremisesMode"
    Value = "Enforce" # alternative is Audit
};@{
    Name = "EnableBannedPasswordCheckOnPremises"
    Value = $true
};@{
    Name = "EnableBannedPasswordCheck"
    Value = $true
};@{
    Name = "LockoutDurationInSeconds"
    Value = 900
};@{
    Name = "LockoutThreshold"
    Value = 15
};@{
    Name = "BannedPasswordList"
    Value = $BannedPasswords
})

$null = New-AzureADDirectorySetting -DirectorySetting $NewSetting

Krupa Gundraju (Larsen & Toubro Infotech Limit) 126

@Vasil Michev

I am facing "Invoke-RestMethod : The remote server returned an error: (400) Bad Request." error using below code

$lockoutDurationInSeconds = '120'  
$lockoutThreshold = '120'  
$bannedPasswordList = 'UnitedStates'  
$body = (@{      
    "values"= @(@{  
        Value = "Enforce"  
        name  = "BannedPasswordCheckOnPremisesMode"  
          
    }; @{  
        Value = $true  
        name  = "EnableBannedPasswordCheckOnPremises"  
          
    }; @{  
        Value = $true  
        name  = "EnableBannedPasswordCheck"  
          
    }; @{  
        Value = $lockoutDurationInSeconds  
        name  = "LockoutDurationInSeconds"  
          
    }; @{  
        Value = $lockoutThreshold  
        name  = "LockoutThreshold"  
          
    }; @{  
        Value = $bannedPasswordList  
        name  = "BannedPasswordList"  
    })  
    "templateId"= "XXXX"  
} | ConvertTo-Json)  
  
  
try {    
    $uri = "https://graph.microsoft.com/v1.0/groupSettings"  
    Invoke-RestMethod -Headers $header -Uri $uri -Method Post -Body $body  -UseBasicParsing   
    Write-Information -InformationAction Continue  "Password protection has been enabled"  
}  
catch {  
    Write-Information -InformationAction Continue  "Failed to set password protection, Error:$($_.exception)"  
    throw  
}

Could you please help me on resolving this?

Possibility of setting Password protection settings in azure AD via graph api/powershell

0 additional answers