According to SecurityWeek, Microsoft is banning common passwords, and they will dynamically update their list:

Microsoft says it is dynamically banning common passwords from Microsoft Account and Azure AD system. […]  Microsoft is seeing more than 10 million accounts being attacked each day, and that this data is used to dynamically update the list of banned passwords.

Is this list based on actual passwords for other people's accounts or just passwords used in brute force attempts?
Could a secure system be built that checked password updates against other people's existing passwords and rejected the update if the password was too common?

We, at Microsoft, are banning the passwords most commonly used in the attacks and nearby variants. We aren't basing this on our user populations, who (because of the system) don't share these passwords unless the attacks change. 

The attack lists generally derive from studying breaches. Attackers are smart enough to look at lists to figure out high probability passwords, then do their brute force, etc. around those high frequency words. We look at the same lists plus the attack patterns to determine our ban lists.

Hope this helps.
