What happens when you exhaust the maximum failed attempts by authenticating yourself using Azure AD?
We use a more method to lock accounts. This is based on the IP address of the request and the passwords entered by the user.