How to Find the Microsoft 365 Account Lockout Policy
Question details
An administrator needs to locate the Microsoft 365 account lockout policy to understand why repeated multifactor authentication (MFA) requests are not locking out accounts.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Investigating Azure sign-in logs after observing repeated multifactor authentication failures that are not triggering an account lockout.
- Observed behavior
- User accounts are experiencing repeated MFA requests and authentication failures, but the accounts remain unlocked despite the suspicious activity.
Ensure you have Global Administrator, Security Administrator, or Authentication Policy Administrator privileges in the Microsoft Entra admin center to view and manage these settings.
Review Microsoft Entra ID Smart Lockout Settings
Microsoft 365 uses Microsoft Entra ID (formerly Azure AD) for authentication, which employs a Smart Lockout feature rather than traditional Windows Server lockout policies.
Microsoft 365 relies on Microsoft Entra ID's Smart Lockout to protect against brute-force password attacks. It is important to note that repeated MFA denials alone may not trigger a standard password lockout if the initial password authentication was successful. The system assumes the password is known, and denying the MFA prompt prevents access without unnecessarily locking out the legitimate user from their account.
Sign in to the Microsoft Entra admin center (entra.microsoft.com) using an account with appropriate administrator privileges.
In the left-hand navigation menu, expand the 'Protection' section and click on 'Authentication methods'.
Select 'Password protection' from the available menu options to view the lockout configurations.
Scroll down to the 'Custom smart lockout' section. Here you can view and modify the 'Lockout threshold' (number of failed sign-ins allowed) and the 'Lockout duration in seconds'.
Contact Microsoft Azure Support for Tenant Guidance
If your policies appear correct but Azure sign-in logs still show unexpected behavior, opening a support ticket can help identify backend issues or complex Conditional Access conflicts.
Looking for a Secure, Lightweight Alternative to Microsoft Office?
While Microsoft 365 offers robust enterprise cloud management, dealing with complex tenant policies and constant authentication prompts can be overwhelming for everyday tasks. If you just need a reliable, secure, and easy-to-use productivity suite for your documents, WPS Office is an excellent free alternative. It provides everything you need to create and edit files locally without the overhead of cloud administration.
Frequently Asked Questions
Why doesn't an MFA failure lock out the account in Microsoft 365?
Entra ID Smart Lockout primarily tracks incorrect password attempts. If an attacker has compromised the password but fails the MFA prompt, the system successfully denies the sign-in without incrementing the 'bad password' counter. This prevents attackers from intentionally locking legitimate users out of their accounts by spamming MFA requests.
Can I set a classic Windows-style account lockout policy for cloud-only Microsoft 365 accounts?
Cloud-only accounts in Microsoft 365 are governed exclusively by Microsoft Entra ID Smart Lockout. You cannot apply classic on-premises Active Directory Group Policy Object (GPO) lockout rules directly to cloud-only identities, though hybrid environments may sync on-premises lockout states.
Where can I see if an account was locked out by Smart Lockout?
You can verify lockouts in the Microsoft Entra ID sign-in logs. Look for sign-in error code 50053, which explicitly indicates that the account is locked because the user tried to sign in too many times with an incorrect user ID or password.
