Which Microsoft Entra Password Protection Resets Fail?
Short answer
E User1, User2, and User3 all fail because their passwords score below the required five points.
Question
Key Takeaways
Microsoft Entra Password Protection requires at least five points for acceptance, where a banned word match gives one point and remaining characters give one point each.
Microsoft Entra Password Protection evaluates passwords against custom and global banned lists, assigning points for matches and remaining characters. This page establishes that passwords must score at least five points to be accepted, causing all three specified attempts to fail.
Common mistake: Assuming that extra characters after a banned word will always make the password acceptable, ignoring the five-point minimum threshold.
Expert Analysis
Why the Answer Is Correct
Microsoft Entra Password Protection evaluates passwords by first normalizing them and then checking for banned words. If a banned word is found, the password receives one point for the match, plus one point for each remaining character not part of the banned word. A password must score at least five points to be accepted. User1's password "C0nt0s0" normalizes to "Contoso" and scores 1 point (1 for the match, 0 remaining), User2's "F@brikamHQ" normalizes to "FabrikamHQ" and scores 3 points (1 for the match, 2 remaining), and User3's "Pr0duct123" normalizes to "Product123" and scores 4 points (1 for the match, 3 remaining). Since all three score below the five-point minimum, all three attempts fail.
Why the Other Options Are Wrong
Options A, B, C, and D suggest that one or more of the password attempts succeed. However, because none of the passwords reach the required five-point threshold, none of them are accepted. Any option excluding a user whose password scores less than five points is incorrect.
Community Comment Notes
Commenters correctly point out that all attempts match the custom banned words and their variations, leading to failure. As AlPers noted, "Each banned password that's found in a user's password is given one point... A password must be at least five (5) points to be accepted." Another user mentioned that "All attempts will fail, because words (and also permutations) are enforced in the custom list."
Official Reference
This link opens the official vendor documentation in a new tab.
Exam Strategy
When evaluating Microsoft Entra Password Protection questions, always calculate the password score: 1 point for the banned word match plus 1 point for each remaining character. If the total is less than five points, the password reset attempt will fail.
Community Votes
100% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 4 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 4
-
AlPers 👍 1After normalization, the password is evaluated as follows: Each banned password that's found in a user's password is given one point. Each remaining character that isn't part of a banned password is given one point. A password must be at least five (5) points to be accepted. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad#how-are-passwords-evaluated
-
NeoTactics 👍 1 Answered EAll attempts will fail, because words (and also permutations) are enforced in the custom list.
-
obaemf 👍 1 Answered EAll attempts matches banned words and their banned variations
-
robluis1987 👍 1I love such easy questions
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.