Azure Compliance ControlsMicrosoft Entra ID
Microsoft Entra ID accounts should have 'Lockout duration in seconds' set to 60 or more
The account lockout duration value determines how long an account retains the status of lockout. It also sets how long before a user can continue to attempt to login after passing the lockout threshold. Lockout duration in seconds should be 60 or more.
What this control checks
Account 'Lockout duration in seconds' must be greater than or equal to '60'.
Framework mappings
The clauses this control is mapped to in each framework.
- 5.7 Ensure that account 'Lockout duration in seconds' is greater than or equal to '60'
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_account_duration_min_60_seconds - Powerpipe Control:
azure_compliance.control.ad_account_duration_min_60_seconds
Last reviewed: 2026-10-09