This article explains why a user might fail to log into Okta with the following error in Okta System Logs, but then can sign back in later with no apparent "Unlock" event.
LOCKED_OUT
- Directories
- Active Directory
- Okta Classic Engine
- Missing unlock event in Okta System Logs.
- Users locked out after too many failed authentication attempts are automatically unlocked, and Okta does not log the unlock event.
Because delegated authentication is used to authenticate the user, an Active Directory Domain Controller performs the login. The LOCKED_OUT status in Active Directory does not propagate to the Okta User Profile. It is only a response to active authentication attempts against AD. If there is an Active Directory domain policy to auto-unlock the account, nothing is logged in Okta.
NOTE: Okta logs will not show lockout events for users locked out in AD if the authentication attempt did not go through Okta.
Confirm whether there is an auto-unlock policy in Active Directory.
