What is the best way to stop excess login attempts for 1 of our users?

Use Microsoft Entra’s built-in protections plus Conditional Access to tightly control where that user can sign in and to automatically mitigate the attack.

1. Harden sign-in for that user
   • Ensure strong authentication (MFA) is required for the user so that even if the password is known, sign-in fails at MFA.
   • Consider using Microsoft Entra ID Protection to block sign-ins when user or sign-in risk is high (for example, “block users if risk = high”). This helps automatically mitigate suspected account compromise.
2. Restrict sign-in location with Conditional Access
   • Create a Conditional Access policy targeting that specific user.
   • Define a named location for the office public IP range.
   • Configure the policy so that:
     • Grant access only when the sign-in originates from the trusted office IP (named location), and
     • Block access from all other locations.
   • For privileged or sensitive accounts, this is explicitly recommended: apply stricter conditions such as “only from trusted IP addresses.”
3. Rely on Smart lockout and Entra protections
   • Smart lockout is always on and will automatically lock the account after repeated failed attempts (default 10 failed attempts for Azure Public tenants, 3 for Azure US Government tenants). This slows down brute-force and password-spray attacks while allowing legitimate users from familiar locations to continue working.
   • Smart lockout differentiates between familiar and unfamiliar locations and maintains separate lockout counters, helping protect against global attack traffic while minimizing impact on normal use.
   • Microsoft Entra ID also analyzes IP and anomalous behavior and can block malicious sign-ins by default, returning error AADSTS50053 when sign-ins are blocked regardless of password validity.
4. Monitor and tune
   • Continue to monitor Sign-in logs for that user for:
     • Many failed authentications from multiple IPs (possible password spray or brute force).
     • “Interrupted” sign-ins with Conditional Access failures, which can indicate that the password is correct but MFA is not being completed (possible compromised password, attacker blocked at MFA).
   • Review whether the Conditional Access and risk policies are too aggressive or too permissive, and adjust to reduce noise while maintaining strong protection.

This combination—Conditional Access restricted to office IP, enforced MFA, ID Protection risk-based blocking, and Smart lockout—provides the most effective way to stop excess login attempts from around the world for that specific user while keeping legitimate office access working.

References:

• Microsoft Entra security operations for user accounts
• Protect user accounts from attacks with Microsoft Entra smart lockout
• Strictly enforce location policies using continuous access evaluation (preview)