Lithnet Password Protection or Microsoft Entra Password Protection?
With Lithnet Password Protection, you're in control of which passwords get blocked in your Active Directory. Bring in the full Have I Been Pwned data set, any other breached password list you choose and your own banned words, and every password your users set is checked against all of them. Microsoft Entra Password Protection relies on a global list that Microsoft maintains, and Microsoft states that this list isn't based on breached password lists. But you don't have to choose one or the other. You can have both products working together to protect your Active Directory.
Here's how the two compare on the things that matter most when you're protecting the passwords in your Active Directory.
| Topic | Microsoft Entra Password Protection (on-premises) | Lithnet Password Protection |
|---|---|---|
| License | Each user who is synchronized from Active Directory needs a Microsoft Entra ID P1 or P2 license. Microsoft Learn | Password Protection is free for every user in your domain, with an optional support plan from Lithnet available for purchase. |
| What you deploy | You install an agent on each domain controller. You also install a proxy service that connects to Entra ID. Microsoft Learn | You install Password Protection on each domain controller. It needs no other servers. |
| Breached password lists | You can't import breached password lists. Microsoft states that its global banned list isn't based on them. Microsoft Learn | You can block every password in Have I Been Pwned and in any other breached password list that you choose. |
| Your own banned words | You can add up to 1,000 terms of your own. Microsoft Learn | You can ban as many words as you need. |
| Length-based and regular-expression rules | No | Yes. For example, you can reward long passwords with fewer complexity rules. |
| Audit of existing passwords | No Microsoft Learn | Yes. You can find the users whose current password is in a breached password list. |
| Microsoft-maintained global banned list | Yes Microsoft Learn | You keep Microsoft's list when you run both products together. |
| Run together | Yes Microsoft Learn | Yes. With both products installed, a new password must pass the checks of both. |
Get started today
Support plans start at USD 750 a year, including 300 users. Lithnet Password Protection runs on your domain controllers, and a support plan ensures you have help available directly from Lithnet when you need it. We're there to help troubleshoot problems, provide advice, and ensure you are first to be notified about security fixes.