Azure AD Password Protection feature blocks commonly used and compromised passwords to reduce the risk of password spray attacks. The feature has been in public preview since June 2018 and is now generally available. It prevents users from using passwords from a list of more than 500 of the most commonly used passwords, plus over 1 million character substitution variations of those passwords. It also comes with an updated banned passwords algorithm, and it will take into account both custom password lists and the lists provided by Microsoft via Azure AD making it possible to block an ever-increasing range of blacklisted passwords.
Source: https://www.bleepingcomputer.com/news/security/azure-ad-password-protection-available-lowers-spray-attack-risks/