Go to Azure Active Directory > Security > Multifactor authentication > Account lockout.Įnter the values for your environment, and then select Save.

Minutes until account is automatically unblocked.

Minutes until account lockout counter is reset.Number of MFA denials that trigger account lockout.The account lockout settings are applied only when a PIN code is entered for the MFA prompt. To prevent repeated MFA attempts as part of an attack, the account lockout settings let you specify how many failed attempts to allow before the account becomes locked out for a period of time. Adding new providers is disabled as of September 1, 2018. This will show any existing authentication providers that you've associated with your account. Used in cloud-based Azure AD Multi-Factor Authentication environments to manage OATH tokens for users.Ĭonfigure settings related to phone calls and greetings for cloud and on-premises environments. Users remain blocked for 90 days from the time that they're blocked or until they're manually unblocked.Ĭonfigure settings that allow users to report fraudulent verification requests.Įnable notifications of events from MFA Server. Any authentication attempts for blocked users are automatically denied. (MFA Server only)īlock specific users from being able to receive Azure AD Multi-Factor Authentication requests. This feature applies only to users who enter a PIN to authenticate. Temporarily lock accounts from using Azure AD Multi-Factor Authentication if there are too many denied authentication attempts in a row. The following Azure AD Multi-Factor Authentication settings are available in the Azure portal: Feature Some settings are available directly in the Azure portal for Azure Active Directory (Azure AD), and some are in a separate Azure AD Multi-Factor Authentication portal. To customize the end-user experience for Azure AD Multi-Factor Authentication, you can configure options for settings like account lockout thresholds or fraud alerts and notifications.

Microsoft two factor authentication