User Account Gets Continuously Locked Out For Weeks

Hi @FinnP.13041 (Customer)​ , Thank you for reaching out to the Okta Community! 

If this is explicitly in the context of the user getting the status "locked out", I've had this experience with users that recently changed their password for Okta but never updated their desktop apps/devices to leverage the new password (for example 3rd party mail app services), so they were automatically attempting authentication with the cached credentials.  

If it's in the context of users just not being able to log in with no error or generic error, I've seen situations where Okta ThreatInsight triggers a false positive in conjunction with maybe VPN use, so the Okta system logs will not display any activity related to the user specifically, because that event triggers before authentication. You'll need to review ThreatInsight logs and correlate the event time-stamps and involved IPs with the user's authentication attempts. 

If my answer helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you. 

Hope my answer helps! 

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

This month's AMA topic: Okta Device Access. Ask away today.

Updating this response for ease of access and reference: 

Overview

An Okta user account experiences repetitive lockouts multiple times a day. This occurs due to cached credentials on devices or Okta ThreatInsight blocking authentication attempts. Resolve this by updating cached credentials on all devices and reviewing Okta ThreatInsight logs for blocked Internet Protocol (IP) addresses.

Applies To

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Account Lockouts
• Okta ThreatInsight

Cause

Repetitive account lockouts occur for two primary reasons. First, the user recently changed the Okta password but did not update desktop applications or mobile devices. These devices automatically attempt authentication using the cached, outdated credentials, causing a lockout. Second, Okta ThreatInsight triggers a false positive, often in conjunction with Virtual Private Network (VPN) usage. In this scenario, Okta blocks the authentication attempt before it reaches the user authentication logs, resulting in login failures without specific user-level error messages.

Solution

How does the administrator resolve cached credential lockouts?

Update the cached credentials across all user devices and applications to prevent automatic authentication failures.

1. Identify all desktop applications, mobile devices, and third-party mail services utilized by the user.
2. Update the saved passwords in each application and device to match the new Okta password.

The administrator reviews Okta ThreatInsight logs for false positives.

Investigate the Okta ThreatInsight logs to identify and correlate blocked authentication attempts associated with the user.

1. Navigate to the Okta System Log.
2. Review the logs for Okta ThreatInsight events that occur around the time the user attempts to authenticate.
3. Correlate the timestamps and involved IP addresses with the user experiencing the login failures.