Somebody says they are locked out. That one phrase covers at least four different states, and each has a different fix.

Picking wrongly costs a round trip with a person who is already frustrated, so the first job is working out which one you are actually looking at.

Symptom

The person cannot get in. What they describe next is the useful part.

The person knows their password is wrong, or has forgotten it. They can enter their password but cannot complete the second step. Their sign-in is refused after several failed attempts. Their sign-in is refused outright with no password prompt. Or everything looks correct and it still fails.

Cause

Each of those is a different state.

A forgotten or wrong password needs a password reset.

A password that works followed by a failure at the second step is a multi-factor problem, and resetting the password will not touch it.

A refusal that follows several failed attempts usually means the account is locked.

Where a client runs their own directory, Avvi can clear that. Where the account is cloud-only there is nothing to clear, and the lockout lifts on its own.

A refusal with no password prompt at all usually means the account is disabled rather than locked.

Everything looking correct and still failing is the hardest case, and it is usually policy, device state or licensing rather than the account itself.

Fix

Ask two questions before doing anything: does the password get accepted before it fails? and how many times did they try?

1. If the password is wrong or forgotten, reset it.
2. If the password is accepted and the second step fails, reset their multi-factor authentication instead.
3. If they have lost the device that does the second step and need in today, a temporary access pass gets them working while they set the device up again.
4. If the password is correct and sign-in is refused after several bad attempts, ask Avvi to unlock the account. On a client with an on-premises connector this clears the real lockout. On a cloud-only client the request still reports success while clearing nothing, so wait for the lockout to lift rather than asking again.
5. If the sign-in is refused with no password prompt at all, check whether the account is disabled.

Avvi confirms before it changes anything, so you can start down one of these and stop if the answer changes.

If something doesn’t look right

If none of the five fits, the account is probably healthy and something around it is blocking the sign-in.

Ask Avvi for the person’s recent failed sign-ins. The reason given there is usually more specific than anything the person can tell you.

If that still does not explain it, open a support conversation from the Help drawer. Include the client name, the person’s email address, what they see, and whether the password is accepted first.

FAQ

Q: Should I reset the password anyway, to be safe?

A: No. If the problem is the second step, a password reset changes nothing and the person now has a new password to learn as well.

Q: How do I tell a disabled account from a locked one?

A: A locked account follows repeated failed attempts. A disabled account is usually refused before the password is asked for at all, and needs enabling instead.

Q: Avvi says it unlocked the account and the person still cannot get in.

A: On a cloud-only client there is no lockout for Avvi to clear, so the request re-enables the account and changes nothing else. Wait for the lockout to lift.

Q: The person says they are locked out of email specifically.

A: That is often a licence or a mailbox problem rather than a sign-in one. Check whether they can sign in to anything else first.