Agent Foskett Academy • Microsoft Entra • Module 2 • Lesson 19

Lesson 19 — Smart Lockout in Microsoft Entra

Password attacks create a difficult balance.

Set the lockout threshold too high and attackers gain more opportunities to guess credentials. Set it too low and attackers can deliberately lock legitimate users out of their accounts.

Microsoft Entra Smart Lockout uses cloud intelligence, familiar and unfamiliar sign-in behaviour, recent bad-password tracking and configurable lockout controls to block likely attackers while reducing disruption for genuine users. This lesson explains how Smart Lockout works, how it interacts with hybrid Active Directory, and how Agent Foskett investigates repeated failures and unexpected lockouts.

Smart Lockout is designed to stop password attacks without giving attackers an easy denial-of-service tool.

Start Lesson Back to Microsoft Entra Academy

Agent Foskett Microsoft Entra Smart Lockout lesson

What you will learn

This lesson explains how Smart Lockout identifies likely password attacks and protects cloud and hybrid identities.

Lockout thresholds

Familiar activity

Hybrid protection

Lockout investigation

Learning objectives

After completing this lesson, you should be able to explain, configure and investigate Microsoft Entra Smart Lockout.

Describe the purpose of Smart Lockout.
Explain familiar and unfamiliar sign-in behaviour.
Understand lockout thresholds and duration.
Explain recent bad-password hash tracking.
Coordinate cloud and on-premises lockout policies.
Investigate repeated password failures and account lockouts.

The problem this solves

Traditional account-lockout policies count failed attempts but cannot always distinguish an attacker from a genuine user who mistyped a password.

This can create either excessive exposure or unnecessary lockouts.

What is Smart Lockout?

Microsoft Entra Smart Lockout detects likely brute-force and password-spray activity while attempting to preserve access for legitimate users.

Password sign-in attempt ↓ Microsoft Entra evaluates the source and password pattern ↓ Familiar or unfamiliar activity is identified ↓ Failed-attempt counters are updated ↓ Threshold is reached ↓ Suspicious sign-in path is temporarily locked ↓ Legitimate familiar activity may remain available

Familiar activity

Microsoft Entra learns characteristics of normal sign-in activity for an account.

Failed attempts from familiar sources are treated separately from unfamiliar activity so an external attacker is less able to lock out the genuine user.

Unfamiliar activity

Attempts from locations or sign-in patterns that do not match the user's established behaviour are tracked independently.

This allows suspicious activity to reach its lockout threshold without necessarily blocking familiar access paths.

Traditional lockout vs Smart Lockout

Capability	Traditional lockout	Smart Lockout
Failed-attempt counting	Counts failures against one account threshold.	Uses additional cloud intelligence and behavioural context.
Familiarity	Usually does not distinguish familiar and unfamiliar activity.	Tracks familiar and unfamiliar sign-in behaviour separately.
Repeated bad password	May count every retry.	Tracks recent bad password hashes to reduce repeated-count inflation.
Denial-of-service resistance	An attacker may intentionally trigger a lockout.	Designed to reduce disruption to legitimate users.

Bad-password hash tracking

Smart Lockout tracks the most recent bad password hashes.

Repeatedly submitting the same incorrect password does not necessarily increment the lockout counter every time, helping reduce lockouts caused by stale cached credentials.

Why this matters

A mobile device, mail client, scheduled task or service may repeatedly submit an old password.

Without smarter handling, one stale credential could quickly lock the user out.

Smart Lockout decision flow

Sign-in fails ↓ Is this one of the recently observed bad passwords? ↓ Is the source familiar or unfamiliar? ↓ Update the relevant lockout counter ↓ Has the configured threshold been reached? ↓ No → Continue monitoring Yes → Apply temporary lockout ↓ Increase protection if repeated lockouts continue

Lockout threshold

The threshold controls how many qualifying failed attempts can occur before Smart Lockout is triggered.

Lower thresholds can block attacks sooner but require careful testing to avoid unnecessary disruption.

Lockout duration

The duration defines how long the account remains locked for the affected sign-in path.

Repeated lockout events can result in progressively longer disruption, so the cause should be investigated rather than ignored.

Default protection

Smart Lockout is enabled by default for Microsoft Entra password authentication.

Tenants with the required licensing can customise threshold and duration settings through Password Protection.

Configuration location

Smart Lockout controls are managed in the Microsoft Entra admin centre under Authentication methods and Password Protection.

Changes should be documented and tested against cloud-only and synchronised accounts.

Cloud and hybrid identity flow

User signs in to Microsoft Entra ↓ Smart Lockout evaluates failed cloud authentication ↓ Cloud threshold blocks the attacker first ↓ On-premises AD DS lockout threshold remains higher ↓ Password attack is less likely to reach the domain controller threshold ↓ Legitimate on-premises access is better protected

Password Hash Synchronisation

With Password Hash Synchronisation, Microsoft Entra validates cloud sign-ins using the synchronised password hash.

Smart Lockout can stop cloud password attacks without directly locking the on-premises Active Directory account.

Pass-through Authentication

Pass-through Authentication validates the password against on-premises Active Directory.

Cloud and AD DS lockout settings must be coordinated carefully so Microsoft Entra blocks attacks before they cause an on-premises account lockout.

Policy alignment

Microsoft recommends setting the on-premises AD DS account-lockout threshold higher than the Microsoft Entra Smart Lockout threshold.

This gives the cloud protection an opportunity to stop hostile attempts before Active Directory locks the account.

Duration alignment

The Microsoft Entra lockout duration should also be considered alongside the AD DS lockout duration.

The goal is to contain cloud attacks without creating inconsistent or confusing recovery behaviour.

Recommended hybrid design

1. Document the Microsoft Entra threshold ↓ 2. Document the AD DS threshold ↓ 3. Keep the AD DS threshold higher ↓ 4. Review the lockout durations ↓ 5. Test Password Hash Sync or Pass-through Authentication ↓ 6. Simulate controlled failed sign-ins ↓ 7. Confirm Microsoft Entra protects the account first ↓ 8. Monitor cloud and domain-controller evidence

Password spray

Password spraying uses one or a few likely passwords across many accounts.

The attacker attempts to remain below simple per-account thresholds, so investigation must look for shared sources and repeated patterns across users.

Brute-force attack

Brute-force attacks submit many candidate passwords against one account.

Smart Lockout limits the attacker's usable attempts and temporarily blocks suspicious authentication activity.

Stale credentials

Repeated failures are often caused by saved credentials rather than an attacker.

Common sources include mobile mail applications, Windows Credential Manager, mapped drives, scheduled tasks, services and old VPN profiles.

Legacy authentication

Older protocols and applications may retry passwords repeatedly without clear user visibility.

Where possible, disable legacy authentication and move applications to modern authentication.

Evidence sources

Evidence source	What it shows	Investigation value
Microsoft Entra sign-in logs	Result codes, IP addresses, locations, applications, clients and authentication details.	Identifies the source and pattern of failed attempts.
Identity Protection	Risky sign-ins, risky users and detections.	Connects lockout behaviour to broader identity risk.
AD DS security logs	On-premises authentication failures and account-lockout events.	Shows whether the cloud attack reached Active Directory.
Endpoint evidence	Saved credentials, services, tasks and application retries.	Finds legitimate devices repeatedly using an old password.
Conditional Access	Access-policy evaluation after authentication.	Separates password failure from policy denial.

Agent Foskett investigation: “The user keeps getting locked out”

1. Confirm whether the lockout is cloud, on-premises or both ↓ 2. Review Microsoft Entra sign-in failures ↓ 3. Group attempts by IP address, application and client ↓ 4. Compare familiar and unfamiliar activity ↓ 5. Check whether one bad password is repeating ↓ 6. Review risky sign-ins and user risk ↓ 7. Inspect AD DS lockout events for hybrid users ↓ 8. Search the user's devices for stale credentials ↓ 9. Revoke sessions and reset credentials if compromise is suspected ↓ 10. Correct the source without weakening lockout protection

Attack indicators

Failures originate from many unfamiliar countries.
One IP address targets numerous accounts.
The same password pattern appears across users.
Failures occur against legacy protocols.
Lockouts continue after the user changes their password.
Successful sign-ins appear between bursts of failures.

Benign indicators

Failures come from a known managed device.
The same stale password is repeatedly submitted.
A service or scheduled task began failing after a password change.
The source IP matches the user's normal location.
Failures stop after saved credentials are removed.
No related user-risk or unfamiliar sign-in evidence exists.

Real-world scenario: the old phone password kept triggering failures

1. A user changes their password ↓ 2. Their desktop signs in successfully ↓ 3. Microsoft Entra records repeated failures ↓ 4. Agent Foskett groups events by application and device ↓ 5. An old mobile mail profile is identified ↓ 6. The profile is still submitting the previous password ↓ 7. Saved credentials are removed ↓ 8. The account is tested successfully ↓ 9. Failed sign-ins stop without lowering the lockout threshold

Common mistakes

Mistake	Impact	Better practice
Lowering the threshold without testing	Legitimate users may experience unnecessary lockouts.	Pilot and monitor changes.
Setting AD DS lower than Microsoft Entra	Cloud attacks may lock the on-premises account first.	Keep the AD DS threshold higher.
Assuming every lockout is malicious	Stale credentials remain unresolved.	Investigate applications, devices and saved passwords.
Assuming every lockout is benign	Password attacks may continue unnoticed.	Review source, location, risk and cross-user patterns.
Ignoring legacy authentication	Older clients may repeatedly submit credentials.	Block legacy authentication where possible.
Unlocking without finding the source	The account is locked again.	Identify and correct the failing client or attacker path.

Key takeaways

Smart Lockout protects Microsoft Entra accounts from password guessing and brute-force attacks.
Familiar and unfamiliar sign-in activity use separate behavioural context.
Recent bad-password tracking reduces repeated lockouts caused by the same stale credential.
Threshold and duration settings should be changed carefully.
Hybrid environments must coordinate Microsoft Entra and AD DS lockout policies.
The on-premises threshold should be higher so cloud protection can act first.
Sign-in logs, identity risk, AD DS events and endpoint evidence reveal the true source.
Never weaken lockout protection before determining whether the cause is attack activity or stale credentials.

Related Agent Foskett resources

Continue developing Microsoft Entra password, authentication and identity investigation skills.

Lesson 18 — Microsoft Entra Password Protection Lesson 17 — Self-Service Password Reset Lesson 16 — Authentication Strengths Lesson 15 — Authentication Methods Policies Lesson 5 — Risky Users and Risky Sign-ins Microsoft Identity and Access Services

Continue learning

Continue through Microsoft Entra identity security, or return to the academy roadmap.

⬅ Previous lesson

Lesson 18 — Microsoft Entra Password ProtectionUnderstand global intelligence, banned passwords and hybrid Active Directory protection.

🏠 Academy home

Microsoft Entra AcademyReview the roadmap and continue through the identity security learning path.

📘 Next lesson

Lesson 20 — Microsoft Entra Identity Protection PoliciesLearn how user and sign-in risk can trigger automated identity protection controls.

Microsoft Entra Smart Lockout and Account Lockout Protection

Microsoft Entra Smart Lockout detects password attacks using familiar and unfamiliar sign-in behaviour, recent bad-password tracking, configurable thresholds and temporary lockout duration.

Microsoft Entra Academy Lesson 19 — Smart Lockout

This Agent Foskett lesson explains Smart Lockout configuration, password spray and brute-force protection, Password Hash Synchronisation, Pass-through Authentication, hybrid AD DS policy alignment and account-lockout investigations.