Back to Checks
m365

Smart lockout threshold is set to 10 or less

entra_password_protection_lockout_threshold_limited
Service: entraSeverity: medium
OfficialBuilt-inVerified
Categories:identity-accesse3
Resource Type:NotDefined

The tenant Password Rule Settings should set the smart LockoutThreshold to 10 or less. The lockout threshold determines how many failed sign-in attempts are permitted before an account is placed in a locked-out state.

Prowler logoProwlerprowler-provider-m365

Risk

A high lockout threshold gives attackers more attempts per account during password spraying and brute-force attacks before lockout is triggered, increasing the chance of a successful credential compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks entra_password_protection_lockout_threshold_limited

Recommendation

Set the smart lockout threshold to 10 or less so accounts lock after a small number of failed sign-in attempts, limiting brute-force and password-spray attacks.

Remediation

Other

1Navigate to the Microsoft Entra admin center at https://entra.microsoft.com/
2Go to **Protection** > **Authentication methods** > **Password protection**
3Set **Lockout threshold** to **10** or less
4Click **Save**

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.entra.entra_client import entra_client
from prowler.providers.m365.services.entra.entra_service import (
    PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
)

# CIS recommends a smart lockout threshold of 10 or less.
MAX_LOCKOUT_THRESHOLD = 10


class entra_password_protection_lockout_threshold_limited(Check):
    """Check if the smart lockout threshold is set to 10 or less.

    The Password Rule Settings directory setting should set LockoutThreshold to 10 or
    less so that accounts are locked after a small number of failed sign-in attempts.

    - PASS: The lockout threshold is 10 or less.
    - FAIL: The lockout threshold is greater than 10 or not configured.
    """

    def execute(self) -> List[CheckReportM365]:
        """Execute the smart lockout threshold check.

        Evaluate whether the Password Rule Settings directory setting limits the smart
        lockout threshold to the recommended maximum. When the settings object is
        absent, no finding is produced.

        Returns:
            List[CheckReportM365]: A list with a single report when the Password Rule
            Settings exist, or an empty list when they are absent.
        """
        findings = []
        settings = entra_client.directory_settings.get(
            PASSWORD_RULE_SETTINGS_TEMPLATE_ID
        )
        if not settings:
            return findings

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=settings or {},
            resource_name="Password Rule Settings",
            resource_id=PASSWORD_RULE_SETTINGS_TEMPLATE_ID,
        )
        report.status = "FAIL"
        report.status_extended = "The smart lockout threshold is not set to 10 or less."

        if settings:
            try:
                threshold = int(settings.get("LockoutThreshold"))
            except (TypeError, ValueError):
                threshold = None
            if threshold is not None and threshold <= MAX_LOCKOUT_THRESHOLD:
                report.status = "PASS"
                report.status_extended = (
                    f"The smart lockout threshold is set to {threshold}, within the "
                    f"recommended limit of {MAX_LOCKOUT_THRESHOLD}."
                )

        findings.append(report)
        return findings

References