Azure AD Password Protection combines a global banned password dictionary with any custom banned password list and applies fuzzy matching (norm alizing case, detecting common char acter substitutions, and splitting words) to block weak variants. In the exhibit, custom enforcement is enabled and the list contains:
Contoso , Litware , Tailwind , and project (plus others). The SC-300 content describes th at if a user attempts a password containing or derived from these terms, even with substitutions like 0 for o or @ for a , it will be rejected.
* C0nt0s0 # matches Contoso via character substitution # blocked .
* Pr0jectlitw@re # includes project and litware wit h substitutions # blocked .
* T@ilw1nd # matches Tailwind with common substitutions # blocked . With custom list enforcement turned on, all three candidate passwords are rejected.