Azure AD b2c smart lockout not working

Question

Azure AD b2c smart lockout not working

mandar Jogalekar 36

I am using azure ad b2c standard sign in user flow. In Authentication methods, I have configured a password protection.

However in the user flow, i Notice the behaviour is random. Sometimes even after entering 6-7 wrong passwords, the account does not get lockout message.

Not really sure how to troubleshoot ?

Accepted answer

0 additional answers

Your answer

Answer 1

AmanpreetSingh-MSFT 56,876 Moderator

Hi @mandar Jogalekar • Thank you for reaching out.

Azure AD B2C uses Smart Lockout, which is different than the traditional account lockout.

When smart lockout locks a user account, we try our best to not lock out the genuine user. However, using smart lockout doesn't guarantee that a genuine user is never locked out. The lockout service attempts to ensure that bad actors can't gain access to a genuine user account. Below considerations are applied:

Each Azure AD data center tracks lockout independently. A user has (threshold_limit * datacenter_count) number of attempts if the user hits each data center.
Smart Lockout uses familiar location vs unfamiliar location to differentiate between a bad actor and a genuine user. Unfamiliar and familiar locations both have separate lockout counters.

So, when you set the Lockout Threshold to 5, it doesn't necessarily lock the account after 5 invalid attempts. This makes testing smart lockout a bit difficult and it is not as straightforward as testing the traditional account lockout settings.

-----------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

mandar Jogalekar 36 Reputation points

2022-04-11T12:26:12.103+00:00

Thank you for your answer. How do I implement a standard locking feature with B2C ? because the smart lockout seems a very difficult feature to test and it may not block all users who put 5 incorrect passwords in sequence which is what i want.
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2022-04-11T14:11:07.227+00:00

@mandar Jogalekar • Unfortunately, this is not something that you can choose to opt-in/opt-out for. It is a step toward a better user experience that most Identity Providers are adopting, including Azure AD, Azure AD B2C, ADFS, and so on.

In my case, to test it out, I used a public VPN solution to connect to different countries and used a test account to make invalid password attempts from each country and confirmed that the account tolerates 5 invalid sign-in attempts and locks out on the 6th invalid sign-in attempt. This is not a convenient way of testing but can confirm that your account lockout policy is taking effect.
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2022-04-12T05:00:39.867+00:00

Hi @mandar Jogalekar • Just checking if you have any further questions regarding this issue. Feel free to tag me in your reply if you have any questions.
mandar Jogalekar 36 Reputation points

2022-04-12T06:50:14.247+00:00

Hello ,

Thank you for the response. How do we implement a traditional lockout for b2c. Is it possible with custom policy ?
AmanpreetSingh-MSFT 56,876 Reputation points Moderator

2022-04-12T08:05:34.817+00:00

Hi @mandar Jogalekar • There is no option to configure traditional lockout. Custom policy also depend on the same account lockout policies that you have mentioned in your question.

Share via

Azure AD b2c smart lockout not working

0 additional answers

Your answer