You configure Azure Active Directory (Azure AD) Password Protection as shown in the exhibit.

Azure AD Password Protection combines a global banned password dictionary with any custom banned password list and applies fuzzy matching (normalizing case, detecting common char acter substitutions, and splitting words) to block weak variants. In the exhibit, custom enforcement is enabled and the list contains: Contoso , Litware , Tailwind , and project (plus others). The SC-300 content describes that if a user attempts a password containing or derived from these terms, even with substitutions like 0 for o or @ for a , it will be rejected.

C0nt0s0 → matches Contoso via character substitution → blocked .

Pr0jectlitw@re → includes project and litware with substitutions → blocked .

T@ilw1nd → matches Tailwind with common substitutions → blocked . With custom list enforcement turned on, all three candidate passwords are rejected.