Disallowed Password List

A disallowed password list lets you block users from choosing passwords that are known, weak, or already compromised. You upload a plain-text file of forbidden passwords. When the check is enabled, EAM rejects any password that exactly matches an entry on the list when a user tries to set or change it.

Use this list to enforce stronger password hygiene and help meet compliance requirements, that call for screening passwords against lists of common or breached credentials.

Before You Begin

  • You need EAM administrator access to the configuration where password policy is managed.

  • Prepare your disallowed-password file:

    • Format: plain text, one password per line.

    • Size limit: up to 10 MB.

    • Source: you supply and maintain the file. It can be your organization's own list of banned terms, a curated breach list, or both combined. EAM does not download or update the list.

Set Up the Disallowed Password List

  1. In the Imprivata Admin Console, go to the gear icon menu > Settings page.

  2. Go to the Known password validation section and select Prevent use of known insecure passwords.

  3. Upload the plain-text file that you prepared.

    If the file exceeds 10 MB, EAM does not accept it. Trim the list and try again.

After you enable the check, EAM applies the list to passwords set or changed through supported password-change flows.

Update or Replace the List

  • To replace the list, upload a new file. The new file replaces the previously uploaded list.

  • To pause enforcement without discarding the uploaded file, deselect Prevent use of known insecure passwords. The uploaded file is retained and takes effect again when you select the option again.

Where the List Applies

EAM checks the disallowed password list when a user sets or changes a password through these flows:

  • Self-Service Password Reset (SSPR): when a user chooses a new password.

  • Windows password change (desktop access): when a user is prompted to change an expired password at the native Windows change-password screen.

Password Rejection Behavior

If a user chooses a password that matches an entry on the list, EAM rejects the password and prompts the user to select a different password. The rejection does not reveal which entry matched or expose any part of the list.

Configure the rejection message in the Imprivata Admin Console settings.

When a password is rejected because it matched the disallowed list, EAM records the rejection event in its logs. For security, the password itself is never logged. Only the rejection event is logged.

Use these events to confirm that the policy is active and to review how often weak passwords are attempted.

Limitations

  • Exact match only. A password is blocked only when it matches a list entry exactly. Passwords that contain a listed word are not blocked. For example, adding summer to the list does not block Summer2026!.

  • New and changed passwords only. Enabling the check does not scan or expire passwords that users already have. It applies the next time a password is set or changed.

  • Out-of-band resets are not checked. Passwords set outside EAM—such as an administrator resetting a password directly in Active Directory—are not screened against the list.