Blocked User Accounts

The blocked user accounts page lists every user currently prevented from signing in — whether by automatic failed-login thresholds, manual admin action, or external policy.

What's Shown

• Username / email identifies the account.
• Reason — auto (failed-attempts threshold), admin (manual action), or policy (e.g. compliance flag from HR).
• Blocked at — timestamp.
• Expires — automatic unblock time, or blank for indefinite.
• Last attempt — when the user (or attacker) last tried to sign in while blocked.

Filtering and Search

• Search by username or email.
• Filter by reason — e.g. show only auto-blocks to assess attack patterns.
• Sort by Last attempt descending to see active attack surface.

Worked Examples

• User locked out: Help desk receives a call. Search for their email; auto-blocked with 5 failed attempts. Force-reset their password and unblock.
• Attack detection: Sort by Last attempt — accounts with high recent attempts are being brute-forced. Add their source IPs to the IP block list.
• Compliance review: Show only “policy” blocks — every account flagged by HR for offboarding or compliance reasons.

Note: A blocked user can still receive emails and trigger password reset flows — but cannot complete the reset until unblocked. Communicate clearly with the user when they're in this state.

Unblocking restores a user's ability to sign in. The right approach depends on why they were blocked — automatic failed-attempt bans are typically safe to lift; admin-blocks need investigation first.

Step-by-Step

1. Open Architect Panel → Blocked User Accounts.
2. Find the user (search by email).
3. Click Unblock.
4. Decide whether to additionally:
   • Force a password reset on next sign-in (recommended after suspicious activity).
   • Clear the failed-attempt counter (always tick — otherwise they may get re-blocked on the very next attempt).
   • Send a notification email explaining the unblock.
5. Confirm.

Self-Service Unblock

Auto-blocks can be configured to lift themselves after a cooldown (e.g. 15 minutes). For routine fat-finger lockouts, this is much friendlier than asking the user to call support.

Worked Examples

• Forgotten password: User typed wrong password 5 times. Verify identity by callback, unblock with password reset forced, send notification.
• After credential theft: Account was admin-blocked because of an alert. Investigate the access log, change the password to a temporary value, unblock, force password change, enrol in 2FA.
• Bulk maintenance: 50 inactive accounts blocked by quarterly review. Re-evaluate each, unblock those still needed, leave the rest blocked or delete.