Skip to content
MitoMito Docs

EIDSCA.PR02: Default Settings - Password Rule Settings - Password Protection - Enable password protection on Windows Server Active Directory.
ID EIDSCA.PR02
Severity High
Suite EIDSCA
Product Entra ID
Related products Active Directory
Feature Password protection
Security area Authentication
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:IA-5(1) Authenticator Management | Password-based Authentication
MITRE ATT&CK T1110
Reads from Microsoft Graph
Licence needed AAD_PREMIUM

What this checks and how to fix it

Section titled “What this checks and how to fix it”

If set to Yes, password protection is turned on for Active Directory domain controllers when the appropriate agent is installed.

Azure identity management and access control best practices - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/settings
.values -eq 'True'
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0006 - Credential Access - Credential Access
    (Mitigation)
      M1018 - User Account Management
      M1027 - Password Policies
    (Technique)
      T1110 - Brute Force
Tactic Technique Mitigation
TA0006 - Credential Access - Credential Access T1110 - Brute Force M1018 - User Account Management
M1027 - Password Policies

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.