CIS.M365.5.2.3.8 - (L1) Ensure that Account 'Lockout threshold' is '10' or less
Overview
The smart lockout threshold does not exceed the recommended maximum of failed sign-in attempts.
Smart lockout slows password guessing and spraying by locking an account out after a number of failed sign-ins. A high threshold gives an attacker more guesses per lockout period.
When the threshold is not stored in the tenant's password rule settings, Microsoft Entra applies its default of 10 failed attempts in public cloud tenants, which meets the recommendation. Lockout duration is checked by a separate test.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Password protection.
- Set Lockout threshold to 10 or less.
- Select Save.
Related links
- Microsoft Entra admin center - Password protection
- Protect user accounts from attacks with Microsoft Entra smart lockout
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.8
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.8 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing, T1110.003 Password Spraying |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.8 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.8, nist-800-53-r5:AC-7 |
| PowerShell test | Test-MtCisSmartLockoutThreshold |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.8.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.8.md