Forum Discussion
Locked account due to many attempts from malicious IP
https://blog.admindroid.com/configure-smart-lockout-in-microsoft-entra/
ok.. So I've done some more reading on this.... and looks like SmartLockout is enabled by default? .. and to modify it, I can do it as described in the blog.... So I am not sure if that will help to modify the default settings...
I am a bit surprised that I do not see anything under "Protection > Identity Protection > Risky users , ..or Risky Sign-in"... Cant understand why - as the user's account was blocked due to lots of attempts from malicious IP. I would expect that user would be visible under Risky Users?From sign-in logs, I could see that those attempts were blocked.... during the password spray attack that was going on that account for 2 days... so smart lockout was doing the job I guess.... as it was blocking it without affecting the real user.... However, due to lots of attempts from attacker, the user account got blocked anyway eventually....
How to protect against this?
- this looks promising... Was not aware of this feature.... If I understand that properly, it has possibility to unlock password after configured duration ... which is what I need... and have it unlocked without admin or user intervention....
Will do more research on this feature and test it 😉
