Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period

Contributed by Merill FernandoAll contributors →

Part of DISA · Entra ID · Password protection · All checks

Run this check

Invoke-Maester -TestId DISA.V-270208

Overview

Microsoft Entra smart lockout locks an account after three failed sign-ins, for at least 15 minutes. (DISA Microsoft Entra ID STIG, V-270208, CAT II).

Online password guessing is cheap. A low lockout threshold with a long lockout duration limits how many passwords an attacker can try against each account.

This test runs the same check as CIS.M365.5.2.3.8 with DISA’s values: a lockout threshold of 3 or fewer (MaximumLockoutThreshold) and a lockout duration of at least 900 seconds (MinimumLockoutDurationSeconds). CIS allows a threshold of 10 and does not check the duration. The Microsoft defaults (10 attempts, 60 seconds) fail.

Remediation action

1. In the Microsoft Entra admin center, go to Entra ID > Authentication methods > Password protection.
2. Set Lockout threshold to 3 and Lockout duration in seconds to 900 or more.
3. Select Save.

Related links

• DISA Microsoft Entra ID STIG: V-270208
• Protect user accounts from attacks with Microsoft Entra smart lockout

Details

Every attribute of this check

Field	Value
Test ID	DISA.V-270208
Severity	Medium
Suite	DISA
Product	Entra ID
Feature	Password protection
Area	Authentication
Resource type	Tenant
User impact	Low
Implementation cost	Low
MITRE ATT&CK	T1110.001 Password Guessing, T1110.003 Password Spraying
Supports benchmark	DISA Microsoft Entra ID STIG (version V1R2), requirement V-270208
Supports controls	disa-stig-entra-id:V-270208, nist-800-53-r5:AC-7
PowerShell test	Test-MtDisaEntraLockout
Services	Graph

Source

• Test: tests/disa/Test.DISA.V-270208.ps1
• Documentation: tests/disa/Test.DISA.V-270208.md