By default, Microsoft 365 will lock out an account for one minute after 10 failed attempts. The account will automatically lock again after each failed sign-in attempt for one minute or longer.