Active Directory and Entra ID (formerly known as Azure AD) have their own password policies to prevent users from using weak and insecure passwords. While these policies can be combined, the level of protection achieved through this approach is still limited.