Password Protection
Ensures the tenant Password Protection are configured with secure lockout thresholds, lockout duration, and banned password enforcement to protect against brute-force and credential-stuffing attacks
Settings this baseline controls
| Setting | What it does |
|---|---|
| On-premises check mode | Specifies the mode for the on-premises banned password check. Can be Audit or Enforce. Learn more |
| On-premises protection enabled | Enables the on-premises banned password check. Learn more |
| Custom list enforced | Enables the cloud banned password check. Learn more |
| Lockout duration seconds | The minimum length in seconds of each lockout. If an account locks repeatedly, this duration increases. Learn more |
| Lockout threshold | How many failed sign-ins are allowed on an account before its first lockout. If the first sign-in after a lockout also fails, the account locks out again. Learn more |
| Custom banned passwords | A list of words, one per line, to prevent your users from using in their passwords. You should include words specific to your organization, such as your products, trademarks, industries, local cities and towns, and local sports teams. Your list can contain up to 1000 words. These are case insensitive, and common character substitutions (o for 0, etc) are automatically considered. Learn more |
Configure it
This baseline sets Microsoft Entra’s account-lockout thresholds and banned-password checking to Octiga’s recommended values.
-
Add the baseline to the tenant directly (Adding a baseline) or through a scheme (Deploying a scheme).
-
Set Lockout threshold to 10 and Lockout duration seconds to 900 (15 minutes). That’s Microsoft’s standard balance between blunting a brute-force attempt and not leaving a genuine user locked out too long, and the lockout lengthens automatically if the same account keeps failing.
-
Leave Custom list enforced off and Custom banned passwords empty unless your organisation wants to ban specific words, such as your MSP’s name, a client’s brand or local terms. There’s nothing to check against until you add some.
-
If the tenant syncs passwords from an on-premises Active Directory, turn on On-premises protection enabled and set On-premises check mode to Enforce, so the banned-password check blocks a weak password rather than only logging it. A cloud-only tenant can leave these as they are.
-
Save. Auto-remediation is safe to turn on for the lockout and banned-password settings; it never affects an account that’s already locked out.
Check it worked
Passing means Entra ID → Authentication methods → Password protection shows a lockout threshold of 10 and a duration of 900 seconds, with the on-premises settings matching those above. Users notice nothing unless they mistype their password repeatedly (a temporary lockout) or try to set a weak or banned password (a rejection at the point of change).
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.