CIS.M365.5.2.3.9 - (L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds
Overview
The smart lockout duration is not shorter than the recommended minimum.
When smart lockout triggers, the account is locked for the configured duration. A very short duration lets an attacker resume guessing almost immediately, which cancels the benefit of the threshold.
When the duration is not stored in the tenant's password rule settings, Microsoft Entra applies its default of 60 seconds, which meets the recommendation. Lockout threshold is checked by a separate test.
Remediation action
- Sign in to the Microsoft Entra admin center.
- Go to Entra ID > Authentication methods > Password protection.
- Set Lockout duration in seconds to 60 or more.
- Select Save.
Related links
- Microsoft Entra admin center - Password protection
- Protect user accounts from attacks with Microsoft Entra smart lockout
- CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.9
Test Metadata
| Field | Value |
|---|---|
| Test ID | CIS.M365.5.2.3.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.9, nist-800-53-r5:AC-7 |
| PowerShell test | Test-MtCisSmartLockoutDuration |
| Services | Graph |
Source
- Test:
tests/cis/Test.CIS.M365.5.2.3.9.ps1 - Documentation:
tests/cis/Test.CIS.M365.5.2.3.9.md