Microsoft Entra ID accounts should have 'Lockout duration in seconds' set to 60 or more
The account lockout duration value determines how long an account retains the status of lockout. It also sets how long before a user can continue to attempt to login after passing the lockout threshold. Lockout duration in seconds should be 60 or more.
The account lockout duration value determines how long an account retains the status of lockout, and therefore how long before a user can continue to attempt to login after passing the lockout threshold.
What this control checks
Account 'Lockout duration in seconds' must be greater than or equal to '60'.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_account_duration_min_60_seconds.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.7 (Ensure that account 'Lockout duration in seconds' is greater than or equal to '60').
Framework mappings
The clauses this control is mapped to in each framework.
- 5.7 Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_account_duration_min_60_seconds - Powerpipe Control:
azure_compliance.control.ad_account_duration_min_60_seconds
Last reviewed: 2026-10-09