If the user is set to require a strong password, then all of the following rules must be met:
* The password must contain at least one lowercase letter.
* The password must contain at least one uppercase letter.
* The password must contain at least one non-alphanumeric character.
* The password cannot contain any spaces, tabs, or line breaks.
* The length of the password must be 8-16 characters.
* The user name cannot be contained in the password.
References:
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-passwords-policy