# Microsoft Entra ID must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period

Microsoft Entra smart lockout locks an account after three failed sign-ins, for at least 15 minutes. (DISA Microsoft Entra ID STIG, V-270208, CAT II).

Source: https://maester.dev/docs/tests/DISA.V-270208

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/merill" title="Merill Fernando · Original author"><img src="https://github.com/merill.png" alt="Merill Fernando" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/merill">Merill Fernando</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/disa">DISA</a> · Entra ID · Password protection · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId DISA.V-270208
```

## Overview

Microsoft Entra smart lockout locks an account after three failed sign-ins, for at least 15 minutes. (DISA Microsoft Entra ID STIG, V-270208, CAT II).

Online password guessing is cheap. A low lockout threshold with a long lockout duration limits how many passwords an attacker can try against each account.

This test runs the same check as [CIS.M365.5.2.3.8](https://maester.dev/docs/tests/CIS.M365.5.2.3.8) with DISA's values: a lockout threshold of 3 or fewer (`MaximumLockoutThreshold`) and a lockout duration of at least 900 seconds (`MinimumLockoutDurationSeconds`). CIS allows a threshold of 10 and does not check the duration. The Microsoft defaults (10 attempts, 60 seconds) fail.

#### Remediation action

1. In the [Microsoft Entra admin center](https://entra.microsoft.com), go to **Entra ID** > **[Authentication methods](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/~/PasswordProtection)** > **Password protection**.
2. Set **Lockout threshold** to **3** and **Lockout duration in seconds** to **900** or more.
3. Select **Save**.

#### Related links

* [DISA Microsoft Entra ID STIG: V-270208](https://cyber.trackr.live/stig/Entra_ID/1/2/V-270208)
* [Protect user accounts from attacks with Microsoft Entra smart lockout](https://learn.microsoft.com/entra/identity/authentication/howto-password-smart-lockout)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | DISA.V-270208 |
| Severity | Medium |
| Suite | DISA |
| Product | Entra ID |
| Feature | Password protection |
| Area | Authentication |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1110.001 Password Guessing, T1110.003 Password Spraying |
| Supports benchmark | DISA Microsoft Entra ID STIG (version V1R2), requirement V-270208 |
| Supports controls | disa-stig-entra-id:V-270208, nist-800-53-r5:AC-7 |
| PowerShell test | [Test-MtDisaEntraLockout](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270208.ps1) |
| Services | Graph |

</details>

## Source

- Test: [`tests/disa/Test.DISA.V-270208.ps1`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270208.ps1)
- Documentation: [`tests/disa/Test.DISA.V-270208.md`](https://github.com/maester365/maester/blob/main/tests/disa/Test.DISA.V-270208.md)