Configuring an account lockout policy in Entra ID joined devices

Hey Rob,

Actually, this is a common point of confusion with Entra ID (Azure AD) joined devices. The settings you found are actually for cloud-only password attacks, not for interactive logins on Windows devices.

For what you're trying to accomplish, you'll need to configure these lockout settings through Entra ID's security policies instead. Here's how to set it up:

Go to the Entra ID admin center

Navigate to Protection > Authentication methods > Password protection

In the "Custom banned passwords" section, you'll find the Lockout threshold setting - this is where you set it to 5 attempts

Below that, set the Lockout duration in seconds to your preferred time (900 seconds = 15 minutes)

These settings will then apply to all your Entra ID joined machines. The policy might take a little while to propagate across all devices.

Hope this clears things up! If this solves your problem, please mark it as accepted.

Harry

Thanks for the reply. That's actually where I have configured it, and it was well over a week ago, but is still not applying. Could this setting take that long to deploy, or is there some other issue?