User Sign-in Errors

Question

Dear Sir/Madam, I'm getting a lot of calls from users who can't sign in, stating that their accounts are being blocked.

Answer 1

Frequent account lockouts could indicate potential attacks. Check the sign-in logs of affected users to identify unusual attempts, such as suspicious IP addresses, browsers, or user agents. You can use the Entra sign-in logs to view the users' sign-in history.

To reduce disruptions for legitimate users, consider enabling Smart Account Lockout, which helps block malicious attempts while allowing genuine users to sign in.
https://blog.admindroid.com/configure-smart-lockout-in-microsoft-entra/

Answer 2

Hi Raffaele

Thanks for using QandA platform

Misconfigured conditional access policies are one of the causes of administrator/user lockouts.

To prevent this, it is always good practice to have an emergency access account (breakglass account) where conditional access, password expiry etc are not applied to the account, and to roll out any CA policies in stages.

To resolve this issue, please contact the global administrator in your tenant and ask them to follow these steps to unblock the user's account:

1. Sign in to the Microsoft 365 portal as a global admin.
2. Under Users, Select Active Users.
3. Locate the user, and then click the user's Display name to open the settings pane.
4. At the top of the pane, select Unblock sign-in.
5. In the Unblock sign-in screen, deselect Block this user from signing in and click Save changes

Additionally, you can check for brute force or security measures. if many users are affected at once, consider if a security policy update or an automated system(like Azure AD conditional access or Okta) is blocking them.

I hope this information is helpful. Please feel free to reach out if you have any further questions.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Obinna