The aim of this post, though, is to discuss Azure AD-connected systems, applications, and cloud-only environments. Of course, you can also disable LM hashes with GPOs, but most places aren’t doing it. In this case, the standard is usually set at 15+ characters, as when a password is created of more than 14 characters, you don’t store the LM hash for it. Your Pa$$word doesn’t matter | Tech Communityīut, if you still need to start modernizing your application log-in processes, and most applications in your environment rely only on either Active Directory or Active Directory Federation Services, please still consider a more complex password. Regarding why your passwords mostly don’t matter, Alex Weinert, Director of Identity Security at Microsoft, wrote a wonderful article way back in 2019 that I suggest you read: Also, in the case of password spray, Azure AD has functions in play to drastically reduce the speed of password spray attacks and increase the time attackers spend guessing a password. The most common attacks, for example, phishing, password spray and credential stuffing, all rely on the fact that your password is either given by the user to the attacker, guessed because it was really simple, or already exposed to attackers because of previous breaches in 3rd parties attacks. Instead, the main enemy is that passwords can be easily gathered and reused from phishing attacks or breaches. But, contrary to what we believe, your password length is not the main enemy when talking about Azure AD, as long as your passwords are not simple.

Windows Hello for Business deployment for AAD joined devicesĪs we all know, passwords are a weak link in our identity processes.

Configure security keys as a sign-in option in Windows.

Windows Hello for Business and FIDO2 security keys.

Fido 2 key