The Azure AD Password Protection DC agent: This component must be installed on all the domain controllers in the Active Directory forest. The agent intercepts password change events on the DC itself to validate them against the policy. If a DC does not have the agent, password changes processed by that specific DC will not be enforced by Azure AD Password Protection.

The Azure AD Password Protection proxy service: This component acts as an intermediary between the on-premises DC agents and the Azure AD cloud service. Microsoft recommends installing the proxy service on domain-joined member servers, not on domain controllers, for security and operational separation. To ensure high availability and redundancy, it should be deployed on at least two servers, making VM1 and VM2 the correct destination.

A custom banned password list: This is a policy configuration, not a software installation. The list of banned passwords is defined and managed globally within the Azure AD tenant (via the Microsoft Entra admin center). The on-premises agents then download this policy via the proxy service.

Microsoft Learn - Plan and deploy on-premises Azure AD Password Protection:

Section: Deployment overview: "The DC Agent software must be installed on all domain controllers in the domain to ensure that all password changes are validated."

Section: Proxy service: "The Proxy service is installed on one or more domain-joined servers... We recommend having at least two Proxy servers for redundancy."

URL: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-bad-on-premises-deploy

Microsoft Learn - Configure the custom banned password list:

Section: Configure the custom banned password list: "To configure the custom banned password list, sign in to the Microsoft Entra admin center... browse to Protection > Authentication methods > Password protection."

URL: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-ban-custom-list