Users that authenticate into Office 365 via a federated server have a maximum of 15 attempts before the account is locked for 30 minutes.  Persistent attempts to log in will exponentially increase the amount of time the account is locket out.