Microsoft Intune service must enforce the limit of three consecutive invalid login attempts by a user during a 15-minute time period

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId DISA.V-267314

Overview

Microsoft Entra smart lockout, which protects Intune sign-ins, locks an account after three failed sign-ins for at least 15 minutes. (DISA Microsoft Intune MDM Service Desktop STIG, V-267314, CAT II).

Intune sign-ins are handled by Microsoft Entra ID, so the lockout rule is checked there. A low threshold with a long lockout limits online password guessing.

This test runs the same check as CIS.M365.5.2.3.8 with DISA’s values: a lockout threshold of 3 or fewer and a lockout duration of at least 900 seconds.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Password protection.
2. Set Lockout threshold to 3 and Lockout duration in seconds to 900 or more.
3. Select Save.

Related links

• DISA Microsoft Intune MDM Service Desktop STIG: V-267314
• Protect user accounts from attacks with Microsoft Entra smart lockout

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-267314
Severity	Medium
Suite	DISA
Product	Entra ID
Feature	Password protection
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1110.001 Password Guessing, T1110.003 Password Spraying
Supports benchmark	DISA Microsoft Intune MDM Service Desktop STIG (version V1R1), requirement V-267314
Supports controls	disa-stig-intune-desktop:V-267314, nist-800-53-r5:AC-7
PowerShell test	Test-MtDisaIntuneDesktopLockout
Services	Graph

Source

• Test: tests/disa/Test.DISA.V-267314.ps1
• Documentation: tests/disa/Test.DISA.V-267314.md