Control: 5.6 Ensure that account 'Lockout threshold' is less than or equal to '10'
Description
The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration.
Account lockout is a method of protecting against brute-force and password spray attacks. Once the lockout threshold has been exceeded, the account enters a lockedout state which prevents all login attempts for a variable duration. The lockout in combination with a reasonable duration reduces the total number of failed login attempts that a malicious actor can execute in a given period of time.
Remediation
Remediate from Azure Portal
- From Azure Home select the Portal Menu.
- Select
Microsoft Entra ID. - Under
Manage, selectSecurity. - Under
Manage, selectAuthentication methods. - Under
Manage, selectPassword protection. - Set the
Lockout thresholdto10or fewer. - Click
Save.
FRemediate from PowerShell
Connect-MgGraph -Scopes "Policy.ReadWrite.AuthenticationMethod"Update-MgPolicyAuthenticationMethodsPolicy -PasswordProtection @{ LockoutThreshold = 10 LockoutDuration = "PT1M"}
Remediate from Azure CLI:
az rest --method patch \ --url'https://graph.microsoft.com/v1.0/policies/authenticationMethodsPolicy' \ --headers 'Content-Type=application/json' \ --body'{"passwordProtection":{"lockoutThreshold":10,"lockoutDuration":"PT1M"}}'
Default Value
By default, Lockout threshold is set to 10.
Usage
Run the control in your terminal:
powerpipe control run azure_compliance.control.cis_v500_5_6Snapshot and share results via Turbot Pipes:
powerpipe loginpowerpipe control run azure_compliance.control.cis_v500_5_6 --shareSQL
This control uses a named query:
with distinct_tenant as ( select distinct tenant_id, display_name, subscription_id, _ctx from azure_tenant)select id as resource, case when (value)::int <= 10 then 'ok' else 'alarm' end as status, case when value is null then t.display_name || ' lockout threshold not configured.' else t.display_name || ' lockout threshold set to ' || value || '.' end as reason, t.tenant_id from distinct_tenant as t, azuread_directory_settingwhere name = 'LockoutThreshold';