Is a surprise phishing drill email allowed to ask for passwords?

We got an internal-looking email asking staff to “confirm” passwords for a drill. I did not enter anything. Curious how other workplaces separate real drills from unsafe practices — general thoughts only.