Microsoft Entra IDOverview
The account lockout duration value determines how long an account retains the lockout status and, therefore, how long before a user can continue to attempt to log in after passing the lockout threshold.
Rationale
Account lockout is a method of protecting against brute-force and password spray attacks. Once the lockout threshold has been exceeded, the account enters a lockout state that prevents all login attempts for a variable duration. The lockout, combined with a reasonable duration, reduces the total number of failed login attempts that a malicious actor can execute in a given period.
Impact
If the account lockout duration is too low (less than 60 seconds), malicious actors can perform more password spray and brute-force attempts over a given period.
If the account lockout duration is too high (more than 300 seconds), users may experience inconvenient delays during lockout.
Default Value
By default, Lockout duration in seconds is set to 60.
Remediation guidance
Azure Portal
- Open the Security | Authentication methods | Password protection.
- Set the
Lockout duration in secondsto 60 or higher. - Click
Save,
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra tenants with low lockout duration
Connectors
Covered asset types
Expected check: eq []
{
connectors(where: { passwordRuleSettings: { lockoutDurationInSeconds_LT: 60 } }) {
...AssetFragment
}
}
