Microsoft Entra ID accounts should have 'Lockout threshold' set to 10 or less
Checks the Microsoft Entra ID account 'Lockout threshold'. Powerpipe check ad_account_lockout_threshold_max_10 is titled "Ensure that account 'Lockout threshold' is less than or equal to '10'".
The account lockout threshold determines how many failed login attempts are permitted prior to placing the account in a locked-out state and initiating a variable lockout duration.
What this control checks
Account 'Lockout threshold' must be less than or equal to '10'.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control azure_compliance.control.ad_account_lockout_threshold_max_10.
Framework-specific interpretation
CIS Azure Benchmark v5.0.0: Mapped to 5.6 (Ensure that account 'Lockout threshold' is less than or equal to '10').
Framework mappings
The clauses this control is mapped to in each framework.
- 5.6 Ensure that account 'Lockout threshold' is less than or equal to '10'
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
ad_account_lockout_threshold_max_10 - Powerpipe Control:
azure_compliance.control.ad_account_lockout_threshold_max_10
Last reviewed: 2026-10-09