
mn5z2 (mn5z2) asked a question.
Im from IT Team and i manage Okta for my organisation, few of our users getting locked out frequently even with no attempt to sign in, and when their account logs are checked it says incorrect password while the users havent attempted to sign-in.
Users get the locked out mails at random time of the day.

Hello @mn5z2 (mn5z2) Thank you for reacting out to our Community!
This could be an attempt to access the account or brute force. We would recommend to review the logs and see where the login attempt are coming from. Please see the following articles that might help:
https://support.okta.com/help/s/article/Troubleshooting-Distributed-Brute-Force-andor-Password-Spray-attacks-in-Okta?language=en_US
https://www.okta.com/resources/whitepaper/how-adaptive-mfa-helps-mitigate-brute-force-attacks/
https://www.okta.com/identity-101/brute-force/#:~:text=Brute%20force%20attack%20types&text=The%20hacker%20chooses%20one%20target,username%20that%20it%20belongs%20to.
Community members help others by clicking Like or Select as Best on responses. Try it today.
Follow us at OktaSupport
Hi Paul,
The issue has been sorted now, the MDM tool Kandji passport was getting hung for few users after they change their password from Okta,and the Kandji passport was attempting to sync in the backend with Okta, hence users were getting locked out. The passport was flushed and asked the users to reboot their system and login using their credentials, once this is done, the users no longer faced the issue aagain.