Depending on the environment, synced users might also be subject to Microsoft Entra ID restrictions such as the global banned password list. For more information, see the [FAQ section](#faq).
### Cloud-only users
For cloud users, the Microsoft Entra ID password policy cannot be customized, except for password expiration.
For detailed information about the Entra ID password policy, see [Microsoft Entra password policies](/entra/identity/authentication/concept-sspr-policy?tabs=ms-powershell#microsoft-entra-password-policies).
Although Microsoft Entra ID doesn't provide the same granular password complexity settings as on-premises AD DS, it does include a global banned password list and a custom banned password list.
The global banned password list is enabled for all tenants and cannot be disabled.
It blocks weak passwords such as admin or baseball.
The custom banned password list allows organizations to register words such as the company name or abbreviations and prevent them from being used in passwords.
For details, see [Global banned password list](/entra/identity/authentication/concept-password-ban-bad#global-banned-password-list).
## Policies evaluated during authentication (password expiration)
Password expiration specifies the maximum number of days a single password can be used.
When the expiration date is reached, users are required to change their password the next time they sign in.
When considering password expiration, it is helpful to look not only at whether the user is a synced user or a cloud user, but also whether authentication occurs on-premises or in the cloud.
Each scenario is described in the next sections. Refer to the section that matches the user type and environment you want to review
### Synced users with password hash synchronization
It is sometimes misunderstood that the on-premises AD DS password expiration is directly synchronized to Microsoft Entra ID.
However, password expiration values for synced users are stored separately in on-premises AD DS and in Microsoft Entra ID.
Because password information exists in both environments, the applied expiration policy depends on where the user signs in (where authentication occurs).
Depending on the environment, synced users might also be subject to Microsoft Entra ID restrictions such as the global banned password list. For more information, see the [FAQ section](#faq).
### Cloud-only users
For cloud users, the Microsoft Entra ID password policy can't be customized, except for password expiration.
For detailed information about the Entra ID password policy, see [Microsoft Entra password policies](/entra/identity/authentication/concept-sspr-policy?tabs=ms-powershell#microsoft-entra-password-policies).
Although Microsoft Entra ID doesn't provide the same granular password complexity settings as on-premises AD DS, it does include a global banned password list and a custom banned password list.
The global banned password list is enabled for all tenants and can't be disabled.
It blocks weak passwords such as admin or baseball.
The custom banned password list allows organizations to register words such as the company name or abbreviations and prevent them from being used in passwords.
For details, see [Global banned password list](/entra/identity/authentication/concept-password-ban-bad#global-banned-password-list).
## Policies evaluated during authentication (password expiration)
Password expiration specifies the maximum number of days a single password can be used.
When the expiration date is reached, users are required to change their password the next time they sign in.
When considering password expiration, it's helpful to look not only at whether the user is a synced user or a cloud user, but also whether authentication occurs on-premises or in the cloud.
Each scenario is described in the next sections. Refer to the section that matches the user type and environment you want to review
### Synced users with password hash synchronization
It's sometimes misunderstood that the on-premises AD DS password expiration is directly synchronized to Microsoft Entra ID.
However, password expiration values for synced users are stored separately in on-premises AD DS and in Microsoft Entra ID.
Because password information exists in both environments, the applied expiration policy depends on where the user signs in (where authentication occurs).