ASD.ISM-1403 - User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts.
Overview
User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations (ISM-1403, Guidelines for system access).
Online password guessing is cheap: an attacker who can try ten passwords per account before a lockout gets ten chances at every account in the tenant. Microsoft Entra smart lockout counts failed sign-ins per account, locks the account for the lockout duration when the threshold is reached, and counts familiar and unfamiliar locations separately so that a user at their usual desk is not locked out by an attacker elsewhere.
This test runs the same check as CIS.M365.5.2.3.8 with ASD's maximum: the lockout threshold must be 5 or fewer (the MaximumLockoutThreshold parameter), where CIS allows 10. The Microsoft default of 10 fails. The ASD Blueprint for Secure Cloud sets a threshold of 5 and a lockout duration of 60 seconds.
Remediation action
- In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Password protection.
- Set Lockout threshold to 5 and Lockout duration in seconds to at least 60.
- Select Save.
Related links
- ISM Guidelines for system access: User account lockouts
- ASD Blueprint for Secure Cloud: Password protection
- Protect user accounts from attacks with Microsoft Entra smart lockout
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1403 |
| Severity | Medium |
| Suite | ASD |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing, T1110.003 Password Spraying |
| Supports benchmark | ASD Information security manual (ISM) (version 2026.09.4), requirement ISM-1403 |
| ISM guideline | Guidelines for system access |
| ISM section | User account lockouts |
| Supports controls | ism:ISM-1403, nist-800-53-r5:AC-7 |
| PowerShell test | Test-MtAsdSmartLockoutThreshold |
| Services | Graph |
Source
- Test:
tests/asd/entra/Test.ASD.ISM-1403.ps1 - Documentation:
tests/asd/entra/Test.ASD.ISM-1403.md