# User accounts are protected by lockout mechanisms aligned to a maximum of five failed logon attempts

User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon…

Source: https://maester.dev/docs/tests/ASD.ISM-1403

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jusso-dev" title="jusso-dev · Original author"><img src="https://github.com/jusso-dev.png" alt="jusso-dev" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jusso-dev">jusso-dev</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/asd">ASD</a> · Entra ID · Password protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ASD.ISM-1403
```

## Overview

User accounts, except for break glass accounts, are protected by fixed or risk-based lockout mechanisms aligned to a maximum of five failed logon attempts, with either indefinite or automated lockout durations (ISM-1403, Guidelines for system access).

Online password guessing is cheap: an attacker who can try ten passwords per account before a lockout gets ten chances at every account in the tenant. Microsoft Entra smart lockout counts failed sign-ins per account, locks the account for the lockout duration when the threshold is reached, and counts familiar and unfamiliar locations separately so that a user at their usual desk is not locked out by an attacker elsewhere.

This test runs the same check as [CIS.M365.5.2.3.8](https://maester.dev/docs/tests/CIS.M365.5.2.3.8) with ASD's maximum: the lockout threshold must be 5 or fewer (the `MaximumLockoutThreshold` parameter), where CIS allows 10. The Microsoft default of 10 fails. The ASD Blueprint for Secure Cloud sets a threshold of 5 and a lockout duration of 60 seconds.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **[Authentication methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)** > **Password protection**.
2. Set **Lockout threshold** to **5** and **Lockout duration in seconds** to at least **60**.
3. Select **Save**.

#### Related links

* [ISM Guidelines for system access: User account lockouts](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/ism/cyber-security-guidelines/guidelines-system-access)
* [ASD Blueprint for Secure Cloud: Password protection](https://blueprint.asd.gov.au/configuration/entra-id/protection/authentication-methods/password-protection/)
* [Protect user accounts from attacks with Microsoft Entra smart lockout](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ASD.ISM-1403 |
| Severity | Medium |
| Suite | ASD |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing, T1110.003 Password Spraying |
| Supports benchmark | ASD Information security manual (ISM) (version 2026.09.4), requirement ISM-1403 |
| ISM guideline | Guidelines for system access |
| ISM section | User account lockouts |
| Supports controls | ism:ISM-1403, nist-800-53-r5:AC-7 |
| PowerShell test | [Test-MtAsdSmartLockoutThreshold](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1403.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/asd/entra/Test.ASD.ISM-1403.ps1`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1403.ps1)
- Documentation: [`tests/asd/entra/Test.ASD.ISM-1403.md`](https://github.com/maester365/maester/blob/main/tests/asd/entra/Test.ASD.ISM-1403.md)