The blocked user accounts page lists every user currently prevented from signing in — whether by automatic failed-login thresholds, manual admin action, or external policy.
What's Shown
- Username / email identifies the account.
- Reason — auto (failed-attempts threshold), admin (manual action), or policy (e.g. compliance flag from HR).
- Blocked at — timestamp.
- Expires — automatic unblock time, or blank for indefinite.
- Last attempt — when the user (or attacker) last tried to sign in while blocked.
Filtering and Search
- Search by username or email.
- Filter by reason — e.g. show only auto-blocks to assess attack patterns.
- Sort by Last attempt descending to see active attack surface.
Worked Examples
- User locked out: Help desk receives a call. Search for their email; auto-blocked with 5 failed attempts. Force-reset their password and unblock.
- Attack detection: Sort by Last attempt — accounts with high recent attempts are being brute-forced. Add their source IPs to the IP block list.
- Compliance review: Show only “policy” blocks — every account flagged by HR for offboarding or compliance reasons.
Note: A blocked user can still receive emails and trigger password reset flows — but cannot complete the reset until unblocked. Communicate clearly with the user when they're in this state.