# Password Protection

> Ensures the tenant Password Protection are configured with secure lockout thresholds, lockout duration, and banned password enforcement to protect against brut…

Ensures the tenant Password Protection are configured with secure lockout thresholds, lockout duration, and banned password enforcement to protect against brute-force and credential-stuffing attacks

## Settings this baseline controls

| Setting                        | What it does                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
| ------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| On-premises check mode         | Specifies the mode for the on-premises banned password check. Can be Audit or Enforce. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)                                                                                                                                                                                                                                                                                                         |
| On-premises protection enabled | Enables the on-premises banned password check. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)                                                                                                                                                                                                                                                                                                                                                 |
| Custom list enforced           | Enables the cloud banned password check. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)                                                                                                                                                                                                                                                                                                                                                       |
| Lockout duration seconds       | The minimum length in seconds of each lockout. If an account locks repeatedly, this duration increases. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)                                                                                                                                                                                                                                                                                        |
| Lockout threshold              | How many failed sign-ins are allowed on an account before its first lockout. If the first sign-in after a lockout also fails, the account locks out again. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad)                                                                                                                                                                                                                                     |
| Custom banned passwords        | A list of words, one per line, to prevent your users from using in their passwords. You should include words specific to your organization, such as your products, trademarks, industries, local cities and towns, and local sports teams. Your list can contain up to 1000 words. These are case insensitive, and common character substitutions (o for 0, etc) are automatically considered. [Learn more](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-password-ban-bad) |

[Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme.

## Configure it

This baseline sets Microsoft Entra's account-lockout thresholds and banned-password checking to Octiga's recommended values.

1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)) or through a scheme ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)).
2. Set **Lockout threshold** to 10 and **Lockout duration seconds** to 900 (15 minutes). That's Microsoft's standard balance between blunting a brute-force attempt and not leaving a genuine user locked out too long, and the lockout lengthens automatically if the same account keeps failing.
3. Leave **Custom list enforced** off and **Custom banned passwords** empty unless your organisation wants to ban specific words, such as your MSP's name, a client's brand or local terms. There's nothing to check against until you add some.
4. If the tenant syncs passwords from an on-premises Active Directory, turn on **On-premises protection enabled** and set **On-premises check mode** to Enforce, so the banned-password check blocks a weak password rather than only logging it. A cloud-only tenant can leave these as they are.
5. Save. **Auto-remediation** is safe to turn on for the lockout and banned-password settings; it never affects an account that's already locked out.

## Check it worked

Passing means **Entra ID → Authentication methods → Password protection** shows a lockout threshold of 10 and a duration of 900 seconds, with the on-premises settings matching those above. Users notice nothing unless they mistype their password repeatedly (a temporary lockout) or try to set a weak or banned password (a rejection at the point of change).

## Standards this addresses

### CIS

- **M365 1.3.1** — CIS M365 Foundations Benchmark 1.3.1
- **M365 5.2.x** — CIS M365 Foundations Benchmark 5.2.x
- **v8 5.2** — CIS Controls v8 Safeguard 5.2

### NIST

- **PR.AC-4** — NIST CSF 2.0 PR.AC-4
- **IA-5** — NIST SP 800-53 IA-5
- **AC-2** — NIST SP 800-53 AC-2

### ISO 27001

- **A.5.17** — ISO/IEC 27001:2022 Annex A.5.17
- **A.8.6** — ISO/IEC 27001:2022 Annex A.8.6

### GDPR

- **Article 32** — GDPR Article 32

**Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)