How to extract the Cloud password complexity policy in Entra ID?

Question

How to extract the Cloud password complexity policy in Entra ID?

Dey, Dipronil 0

Is there any way to extract via powershell or API call to get the complexity policy settings and all of the below settings. I know it is fixed and can not be customized.

|Property|Requirements| | -------- | -------- | |Characters allowed|Uppercase characters (A - Z) Lowercase characters (a - z) Numbers (0 - 9) Symbols: - @ # $ % ^ & * - _ ! + = [ ] { } | \ : ' , . ? / ~ " ( ) ; < > - blank space| ||| |Characters allowed|Uppercase characters (A - Z) Lowercase characters (a - z) Numbers (0 - 9) Symbols: - @ # $ % ^ & * - _ ! + = [ ] { } | \ : ' , . ? / ~ " ( ) ; < > - blank space| |Characters not allowed|Unicode characters. Note: For Microsoft Entra External ID tenants, Unicode characters are allowed if the user is created by using Microsoft Graph API or Self-Service Sign-Up.| |Password length|Passwords require - A minimum of 8 characters - A maximum of 256 characters| |Password complexity|Passwords require three out of four of the following categories: - Uppercase characters - Lowercase characters - Numbers - Symbols Note: Password complexity check isn't required for Education tenants.| |Password not recently used|When a user changes their password, the new password shouldn't be the same as the current password.| |Password isn't banned by Microsoft Entra Password Protection|The password can't be on the global list of banned passwords for Microsoft Entra Password Protection, or on the customizable list of banned passwords specific to your organization.|

0 comments

1 answer

Your answer

Answer 1

Unfortunately, AFAIK - no. For Microsoft Entra ID cloud passwords, Microsoft does not expose the fixed password-complexity rules you listed as a readable PowerShell property or Microsoft Graph setting. The requirements are enforced by the Entra authentication service rather than stored as tenant-configurable policy values.

You can retrieve the configurable password-related settings, such as password expiration policy, through Microsoft Graph/PowerShell, but you cannot query values such as “minimum 8 characters,” “three of four complexity categories,” or the exact allowed/blocked character set because those are fixed Microsoft-defined rules.

However, the settings you are referring to already documented in https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy?tabs=ms-powershell#microsoft-entra-password-policies

If the above response helps answer your question, remember to "Accept Answer" so that others in the community facing similar issues can easily find the solution. Your contribution is highly appreciated.

hth

Marcin