Created by Claude - please verify

Password protection - the 'Password Rule Settings' directory setting (or Microsoft's defaults when it does not exist).

Required Microsoft Graph permissions

Directory.Read.All — application permission, granted to the app registration with admin consent.

Licence: Custom banned-password list and on-premises password protection need Entra ID P1.

Endpoint: GET /v1.0/groupSettings (Password Rule Settings template)

If a permission is missing, this report shows a red load error with the Graph status code — not an empty table.

Password Protection & Smart Lockout Settings

Smart lockout and banned passwords are the first line against password spraying. Lockouts & Password Spray shows lockout events; this report shows how the protection is configured - especially whether on-premises password protection only audits instead of enforcing.