For brute force password attacks: Extranet Smart Lockout (ESL)

• Extranet Smart Lockout (ESL) is the direct mechanism designed to protect against password spray and brute-force attacks by intelligently locking out attackers based on risk signals (like unfamiliar locations), while allowing legitimate users to continue signing in. ESL (or its successor, Azure AD Smart Lockout, which integrates with PTA) prevents the cloud attacker from causing an account lockout on the sensitive on-premises AD where the password verification happens with PTA.

For leaked credentials: Azure AD Password Protection

• Azure AD Password Protection prevents users from setting passwords that are known to be compromised or are on a globally banned list of weak passwords. By preventing the use of passwords already found in data breaches, it directly minimizes the impact of attackers attempting to use leaked credentials against your users. This protection can be extended to the on-premises AD to work with PTA.

Azure AD Smart Lockout (for Brute Force Mitigation):

Source: Microsoft Learn, "Prevent attacks using smart lockout."

Detail: "Smart lockout helps lock out bad actors that try to guess your users' passwords or use brute-force methods to get in... Smart lockout can be integrated with hybrid deployments that use... pass-through authentication to protect on-premises Active Directory Domain Services (AD DS) accounts from being locked out by attackers." (Conceptual documentation on the feature's role).

Azure AD Password Protection (for Leaked Credential Mitigation):

Source: Microsoft Learn, "Enforce Azure AD Password Protection."

Detail: "Azure AD Password Protection detects and prevents the use of passwords that are known to be compromised, helping to minimize the impact of leaked or weak credentials." (Conceptual documentation section on purpose).

Hybrid Identity Security Principles:

Source: Microsoft Learn, "Steps to secure identities."

Detail: Lists the primary defenses against password attacks, classifying Smart Lockout as the tool for mitigating high-volume sign-in attacks and Password Protection (banned passwords) as the tool for mitigating dictionary and known compromised credentials.