What this check looks at
Checks that Entra smart lockout locks an account after 10 or fewer failed sign-ins for at least 60 seconds. Microsoft’s defaults meet both.
Smart lockout is how Entra ID slows password guessing. After a number of failed sign-ins (the lockout threshold) it locks the account for a time (the lockout duration), and each further lockout lasts longer. It tells familiar locations from unfamiliar ones, so an attacker is locked out before the real user is. Microsoft’s defaults are 10 failed sign-ins and 60 seconds; tenants with Entra ID P1 can change both.
The check reads Lockout threshold and Lockout duration in seconds from the password protection settings and passes when the threshold is 10 or fewer and the duration 60 seconds or more, as CIS asks. A tenant that has never saved password protection settings runs on the defaults and passes. It fails when either value is weaker, and reports partly checked or not checked when a value was not returned.
Raising the threshold, or shortening the lockout, usually happens to stop helpdesk calls about lockouts. The cost is that a password spray or brute-force attack gets more guesses against every account in the same time.
Why it matters
Smart lockout is what slows password guessing against Entra ID. A higher threshold or a shorter lockout lets an attacker try more passwords against each account in the same time.
A brute-force attack tries password after password against one account; a spray tries a few common ones against every account, pacing itself to stay under the lockout limit. With the threshold at 50 and a 10-second lockout, either gets far more guesses at each account in the same time than with Microsoft’s defaults, so a weak or reused password is found sooner.
Lockout is not a replacement for multifactor authentication, which stops a guessed password being enough; but it limits how quickly passwords can be guessed for the accounts and protocols MFA does not yet cover.
CIS Microsoft 365 Foundations Benchmark v7.0.0 5.2.3.8 asks for a lockout threshold of 10 or fewer and 5.2.3.9 for a lockout duration of at least 60 seconds. NCSC’s password guidance recommends throttling or locking out repeated failed attempts.
How to fix it
Where: Entra admin centre → Entra ID → Authentication methods → Password protection
Before you start
- Find out why the values were changed; an old device or app retrying a stale password is the usual cause of lockout calls. Changing the values needs Entra ID P1.
Step by step
- Find out why the values were changed. Ask the tenant whether the lockout settings were changed deliberately, usually because of lockout calls to the helpdesk. If so, look at what was locking accounts first: an old device or app retrying a stale password is the usual cause, and fixing it is better than loosening lockout.
- Set the threshold and duration. In the Microsoft Entra admin centre, go to Entra ID > Authentication methods > Password protection. Set Lockout threshold to 10 or fewer (below 3 tends to lock real people out often) and Lockout duration in seconds to 60 or more (above 300 makes lockouts tiresome). Select Save. Changing these needs Entra ID P1.
- Check Active Directory in a pass-through tenant. If the tenant signs in with pass-through authentication, Entra must lock first. Set the Active Directory account lockout threshold at least two to three times Entra’s, and make Entra’s duration longer than Active Directory’s; Active Directory counts in minutes, Entra in seconds.
- Confirm the settings. Reopen the Password protection page and check both values, or ask the next assessment to read them. The check passes once the threshold is 10 or fewer and the duration 60 seconds or more.
What users will notice
Accounts lock sooner, or for longer, after repeated failed sign-ins. Smart lockout tells familiar locations from unfamiliar ones, so real users are rarely affected.
How to confirm it worked
Entra admin centre → Entra ID → Authentication methods → Password protection shows Lockout threshold 10 or fewer and Lockout duration in seconds 60 or more.
Frameworks and controls
This check maps to controls in 11 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.a Identity verification, authentication and authorisation |
| NIS2 | Art. 21(2)(j) Multi-factor authentication and secured communications |
| Microsoft Cloud Security Benchmark | IM-6 Use strong authentication controls |
| Zero Trust | Identities |
| SOC 2 | CC6.1 Logical access security software, infrastructure and architectures |
| NIST SP 800-171 | 3.1.8 Limit unsuccessful logon attempts |
| CMMC Level 2 | AC.L2-3.1.8 Unsuccessful Logon Attempts |
| ISO 27001:2022 | A.8.5 Secure authentication |
| CIS M365 | 5.2.3.8 Ensure that Account 'Lockout threshold' is '10' or less5.2.3.9 Ensure that Account 'Lockout duration in seconds' is at least 60 seconds |
| NIST CSF 2.0 | PR.AA-03: Users, services, and hardware are authenticated |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Protect user accounts from attacks with Microsoft Entra smart lockout (Microsoft Learn)