Password Policies and Recommendations

As per Microsoft baseline recommendation, good practice to fine tune password lockout threshold from 15 invalid logon attempts to 10 invalid logon attempts

 

Minimum is password length is 8 characters as per Microsoft guidelines (Password policy recommendations - Microsoft 365 admin | Microsoft Docs)

Windows security baseline recommend configuring a threshold of 10 invalid sign-in attempts

Account lockout threshold (Windows 10) - Windows security | Microsoft Docs