How to Set Up an Account Lockout Policy in Microsoft 365 to Prevent Brute-Force Password Attacks

Summary

This guide helps you troubleshoot and resolve: How to Set Up an Account Lockout Policy in Microsoft 365 to Prevent Brute-Force Password Attacks. Follow the steps below to fix the issue.

Common Causes

Account lockout policies are a critical security measure for any organisation using Microsoft 365. By automatically locking an account after a set number of failed login attempts, you can prevent attackers from using brute-force methods to guess passwords and gain unauthorised access to your business data.

Quick Fix Steps

1. Sign in to the Microsoft Entra admin centre.
2. Navigate to Protection > MFA > Account lockout.
3. Configure your lockout threshold and duration.
4. Save your changes.

Detailed Instructions

Step 1: Access the Microsoft Entra admin centre

1. Open your web browser and go to the Microsoft Entra admin centre.
2. Sign in using an account with Global Administrator or Security Administrator privileges.

Step 2: Navigate to Account Lockout settings

1. In the left-hand navigation menu, select Protection.
2. Under Protection, select MFA.
3. Click on Account lockout.

Step 3: Configure lockout settings

1. Enter the number of failed sign-in attempts allowed before an account is locked in the Lockout threshold field. We recommend a value between 5 and 10.
2. Enter the duration in seconds that the account will remain locked in the Lockout duration in seconds field. A common setting is 600 seconds (10 minutes).
3. Click Save to apply the policy.

Tip: Setting the lockout duration too short may not deter a determined attacker, while setting it too long may result in more support tickets for locked-out accounts.

Troubleshooting

Account is locked and user cannot sign in

If a legitimate user is locked out of their account, an administrator can manually reset the lockout status or wait for the lockout duration to expire. You can also assist the user with a Password reset (Windows login) if they have forgotten their credentials.

Settings are not applying

Ensure that the account you are using to make these changes has the necessary administrative permissions. Changes to security policies may take a few minutes to propagate across the Microsoft 365 environment.

If you require further assistance configuring your security settings, please Open a Ticket with our support team.

Still Having Issues?