Skip to content
MitoMito Docs

EIDSCA.PR06: Default Settings - Password Rule Settings - Smart Lockout - Lockout threshold.
ID EIDSCA.PR06
Severity Medium
Suite EIDSCA
Product Entra ID
Feature Password protection
Security area Authentication
Resource type Tenant
User impact of fixing Low
Effort to fix Low
Framework controls nist-800-53-r5:AC-7 Unsuccessful Logon Attempts
MITRE ATT&CK T1110
Reads from Microsoft Graph
Licence needed AAD_PREMIUM

What this checks and how to fix it

Section titled “What this checks and how to fix it”

How many failed sign-ins are allowed on an account before its first lockout. If the first sign-in after a lockout also fails, the account locks out again.

Prevent Attacks Using Smart Lockout - Microsoft Entra ID - Microsoft Learn

Test script

Section titled “Test script”
https://graph.microsoft.com/beta/settings
.values -le 10
Section titled “Related links”

MITRE ATT&CK

Section titled “MITRE ATT&CK”
mindmap
  root{{MITRE ATT&CK}}
    (Tactic)
      TA0006 - Credential Access - Credential Access
    (Mitigation)
      M1018 - User Account Management
      M1027 - Password Policies
    (Technique)
      T1110 - Brute Force
Tactic Technique Mitigation
TA0006 - Credential Access - Credential Access T1110 - Brute Force M1018 - User Account Management
M1027 - Password Policies

Mito check, based on EIDSCA. Author: Cloud-Architekt. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).

© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.