Lock accounts after {{ lockout_threshold }} failed sign-ins for at least {{ lockout_duration_seconds }} seconds

Description

Microsoft Entra smart lockout is configured with a Lockout threshold of at most {{ lockout_threshold }} failed sign-ins and a Lockout duration in seconds of at least {{ lockout_duration_seconds }}. Each new failure after the first lockout locks the account again, for an increasing duration.

Smart lockout keeps separate counters for familiar and unfamiliar locations and ignores repeated attempts with the same wrong password, so the genuine user is rarely locked out by an attacker.

Without Microsoft Entra ID P1 the defaults apply (10 attempts, 60 seconds) and cannot be changed; they already meet the baseline profile. Hash tracking of repeated wrong passwords is not available with pass-through authentication.

Rationale

Limiting the number of guesses per account per unit of time makes online brute force and slow password spray impractical. The threshold must stay high enough that attackers cannot lock users out at will: Microsoft Entra accounts are reachable from the whole internet, which is why a very low threshold such as 3 is not used.

Impact

Users who mistype their password many times wait for the lockout or use self-service password reset (I forgot my password resets the lockout). With pass-through authentication, the Entra threshold must be lower than the Active Directory one and the duration longer, so that attackers cannot lock on-premises accounts through the cloud. The hardened value of 5 slightly increases help-desk calls.

Applies when

Requires: Microsoft Entra ID P1

Setting

Parameters

The value used is your override (tailoring file), else the profile's, else the one of the profile it extends, else the default. Bounds limit what an override may set.

Audit

1. Sign in to the Microsoft Entra admin center (https://entra.microsoft.com) as at least a Global Reader.
2. Browse to Entra ID > Authentication methods > Password protection.
3. Under Custom smart lockout, check that Lockout threshold is {{ lockout_threshold }} or less and Lockout duration in seconds is {{ lockout_duration_seconds }} or more.
4. Alternative in PowerShell (Microsoft Graph, scope Directory.Read.All): (Get-MgGroupSetting | Where-Object DisplayName -eq 'Password Rule Settings').Values shows LockoutThreshold and LockoutDurationInSeconds. No object means the defaults (10 and 60).
5. If pass-through authentication is used, check in the Active Directory lockout policy that its threshold is at least twice the Entra one and its duration shorter.
6. Fail if the threshold is above {{ lockout_threshold }} or the duration below {{ lockout_duration_seconds }} seconds.

Remediation

1. Sign in to the Microsoft Entra admin center as at least an Authentication Policy Administrator.
2. Browse to Entra ID > Authentication methods > Password protection.
3. Under Custom smart lockout, set Lockout threshold to {{ lockout_threshold }} and Lockout duration in seconds to {{ lockout_duration_seconds }} or more.
4. Select Save.

Rollback

Set the values back to 10 and 60 seconds.

References

• Protect user accounts from attacks with Microsoft Entra smart lockout Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-AUTH-036 Enforce a custom banned password list with the organization's own terms
• related CB-M365-AUTH-039 Enable self-service password reset for all users

People and lifecycle