Microsoft Entra IDOverview
The account lockout threshold determines how many failed login attempts are permitted before the account is locked out and initiated with a variable lockout duration.
Rationale
Account lockout is a method of protecting against brute-force and password spray attacks. Once the lockout threshold has been exceeded, the account enters a lockout state that prevents all login attempts for a variable duration. The lockout, in combination with a reasonable duration, reduces the total number of failed login attempts that a malicious actor can execute in a given period of time.
Impact
If the account lockout threshold is set too low (less than 3), users may experience frequent lockout events, and the resulting security alerts may contribute to alert fatigue.
If the account lockout threshold is set too high (more than 10), malicious actors can programmatically execute more password attempts in a given period.
Default Value
By default, the Lockout threshold is set to 10.
Remediation guidance
Azure Portal
- Open the Security | Authentication methods | Password protection.
- Set the
Lockout thresholdto 10 or fewer. - Click
Save,
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Microsoft Entra ID
Use tenant-wide Conditional Access, role settings, authentication policies, and identity governance baselines so the control is enforced centrally.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Entra tenants allowing too many login attempts
Connectors
Covered asset types
Expected check: eq []
{
connectors(where: { passwordRuleSettings: { lockoutThreshold_GT: 10 } }) {
...AssetFragment
}
}
