# (L1) Ensure that Account 'Lockout duration in seconds' is at least 60 seconds

The smart lockout duration is not shorter than the recommended minimum.

Source: https://maester.dev/docs/tests/CIS.M365.5.2.3.9

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jeremyfinney-lgtm" title="jeremy finney · Original author"><img src="https://github.com/JeremyFinney-lgtm.png" alt="jeremy finney" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jeremyfinney-lgtm">jeremy finney</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/cis">CIS</a> · Entra ID · Password protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId CIS.M365.5.2.3.9
```

## Overview

The smart lockout duration is not shorter than the recommended minimum.

When smart lockout triggers, the account is locked for the configured duration. A very short duration lets an attacker resume guessing almost immediately, which cancels the benefit of the threshold.

When the duration is not stored in the tenant's password rule settings, Microsoft Entra applies its default of 60 seconds, which meets the recommendation. Lockout threshold is checked by a separate test.

#### Remediation action

1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com).
2. Go to **Entra ID** > **Authentication methods** > [**Password protection**](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection).
3. Set **Lockout duration in seconds** to 60 or more.
4. Select **Save**.

#### Related links

* [Microsoft Entra admin center - Password protection](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)
* [Protect user accounts from attacks with Microsoft Entra smart lockout](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout)
* [CIS Microsoft 365 Foundations Benchmark v7.0.0 - 5.2.3.9](https://www.cisecurity.org/benchmark/microsoft_365)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | CIS.M365.5.2.3.9 |
| Severity | Medium |
| Suite | CIS |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing |
| Supports benchmark | CIS Microsoft 365 Foundations Benchmark (version 7.0.0), requirement 5.2.3.9 |
| Benchmark level | L1 |
| Benchmark profiles | E3 Level 1 |
| Supports controls | cis-m365:5.2.3.9, nist-800-53-r5:AC-7 |
| PowerShell test | [Test-MtCisSmartLockoutDuration](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.9.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/cis/Test.CIS.M365.5.2.3.9.ps1`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.9.ps1)
- Documentation: [`tests/cis/Test.CIS.M365.5.2.3.9.md`](https://github.com/maester365/maester/blob/main/tests/cis/Test.CIS.M365.5.2.3.9.md)