@kaya3 maybe the misunderstanding is that @Ja1024 was trying to point out how this scheme might or might not be technically possible when I first asked my question. Only now do I have the internal details of how the policy operates. But his answer his answer is still very relevant here because he pointed out that “similarity check requires the password to be stored in a recoverable form” even before I released my details. So he not only is right but had predicted this before I had found out.