Entra smart lockout: tuning it properly against password spraying
Smart lockout is enabled in every Entra ID tenant, which is exactly why it tends to be forgotten. Its defaults suit many organisations, but in a hybrid environment, a poor alignment with the Active Directory lockout policy can turn an attack from the internet into a denial of service on users' workstations.
What smart lockout does
Smart lockout temporarily blocks sign-in attempts to an account after a number of failed password attempts. Unlike classic Active Directory lockout, it does not try to lock the account for everyone: it tries to tell the legitimate user apart from the attacker, slowing the latter down without penalising the former.
Two mechanisms make this possible. First, familiar and unfamiliar locations are counted separately: failures coming from an unusual location do not necessarily lock out a user signing in from their usual network. Second, Entra ID remembers the most recent bad password hashes, so a user who types the same old password several times does not increase the counter on every attempt.
Threshold and duration: the two settings
The settings live under Authentication methods, in the Password protection section. Two values are exposed:
- Lockout threshold: the number of failures allowed before the first lockout. The default is 10 for commercial tenants;
- Lockout duration: the length of the first lockout, in seconds (60 by default). Subsequent lockouts get progressively longer.
Customising these values requires a Microsoft Entra ID P1 licence or higher; check the current prerequisites in Microsoft's documentation. The same page manages the custom banned password list, a useful companion to lockout: an obvious password is rejected when it is set, before an attacker ever gets to try it.
Interaction with Active Directory
In a hybrid environment, the behaviour depends on the authentication method in use.
- Password hash synchronisation (PHS): validation happens in the cloud. Smart lockout applies on its own, and failures on the Entra ID side do not lock the Active Directory account.
- Pass-through authentication (PTA): every attempt is forwarded to an agent that validates it against a domain controller. Without care, an attack launched from the internet can lock accounts in Active Directory and stop users from signing in to Windows.
With PTA, two alignment rules apply:
| Setting | Rule |
|---|---|
| Lockout threshold | The Entra ID threshold must be lower than the Active Directory domain policy threshold. |
| Duration | The Entra ID duration must be longer than the Active Directory lockout counter reset time. |
That way, Entra ID stops the attacker before Active Directory locks the account, and the on-premises counter has time to reset.
Fine-grained policies. Do not stop at the default domain policy. Fine-grained password policies (FGPP) often apply a lower threshold to specific groups, administrators in particular. That lowest threshold is the one to use as your reference.
Defending against password spraying
Password spraying means trying a handful of common passwords against a large number of accounts, slowly, staying below each account's threshold. Smart lockout slows it down but cannot stop it alone. It has to be part of a wider set of controls:
- Block legacy authentication, which cannot enforce MFA and remains the favourite channel for these attacks.
- Require MFA for every user through Conditional Access, so that a guessed password is not enough.
- Extend the banned password list with the organisation's name, brands and locations.
- Monitor sign-in logs: a rise in error codes 50126 (invalid credentials) and 50053 (account locked) spread across many accounts, from a small number of IP addresses, is the typical signature of a spray.
If you have Entra ID Protection, spray-related risk detections should feed a Conditional Access policy based on user risk.
What an audit checks
- The configured threshold and duration, and whether they fit the authentication method.
- With PTA, alignment with the domain policy and every fine-grained policy.
- The contents of the custom banned password list.
- Whether legacy authentication is actually blocked.
- Monitoring of sign-in failures and mass lockouts.