Okta Users Experience Lockouts Due to Multiple Failed Login Attempts via a Rich Client

Okta users experience account lockouts due to multiple failed login attempts originating from a rich client application. This issue occurs when stale credentials remain cached in the local credential manager, which the application repeatedly sends to Okta for authentication. Resolve this issue by clearing the cached Microsoft credentials from the local machine and ensuring the local device password synchronizes with the Okta password. The observable symptom is an account lockout triggered by repeated authentication failures from a rich client.

• Okta Classic Engine
• Okta Identity Engine (OIE)
• Microsoft Office 365 (O365)
• Outlook Thick Client

Whenever a Microsoft Office 365 thick-client application session expires, Microsoft automatically retrieves the credentials stored in the local credential manager on the desktop and passes those credentials to Okta for authentication. If the credentials are no longer valid, authentication via rich client failures appear in the System Log because authentication with the Identity Provider (IdP) fails. Administrators can verify this by searching for the eventType eq "user.authentication.auth_via_richclient" query in the System Log. Checking the User Agent and IP address verifies if the logins originate from valid devices or IP addresses. If the system recognizes the device and IP address, the issue relates to stale credentials in the local credential manager or Keychain Access application. If the device and IP address are invalid, administrators must investigate further to determine the origin of the requests.

How are rich client authentication failures resolved?

Clear cached Microsoft passwords on the local machine and synchronize the device password with the Okta password by performing the following steps.

1. 1. Open the Credential Manager application on Windows or the Keychain Access program on macOS.
   2. Locate and remove any Microsoft or Outlook-related credentials.
   3. Log out and log back into the machine.
   4. Verify whether the user enters the Okta password on the Windows login screen or a different password. If the password fails to synchronize properly, the user might still access the device with a non-Okta password, but Okta logs the event as a failure since it does not receive the expected Okta password.
   5. Synchronize or reset the user password on the machine to match the Okta password.