Viewing Blocked Accounts

The blocked account register lists accounts currently banned after failed sign-ins.

Where to find it

Architect Panel → Security:

• Blocked User Accounts — accounts banned automatically or manually
• Disabled User Accounts — accounts disabled administratively — a different thing
• Blocked IP Addresses — the address-level register

What an entry records

• The account, by the platform's three-part identity — sign-in method, unique identifier and domain.
• The time it was blocked.
• A manual flag.

The three-part identity matters here: it distinguishes the same person arriving by different sign-in methods, so an account banned on one route is identifiable without ambiguity.

Blocked and disabled are different lists

This is the single most useful thing to know when handling a lock-out.

• Blocked — a security response to failed attempts. Usually automatic and temporary, with no reason recorded because there is nothing to record beyond "too many failures".
• Disabled — an administrative decision, held separately with a reason, a source, who changed it and when. It does not expire.

A leaver is disabled. Somebody who mistyped their password is blocked. They present identically to the user and are resolved completely differently.

Check three things on a lock-out

1. Is the account blocked?
2. Is their address blocked?
3. Is the account disabled?

Checking one and stopping is why lock-outs get reported as unresolved after somebody has already "fixed" them.

Reading the list

The same account appearing repeatedly is the pattern worth attention — a targeted account, a shared account, or a stale saved credential retrying somewhere. All three deserve action; none is fixed by clearing the block.

Automatic entries clear themselves

Leave them unless somebody is waiting. Ten minutes passes faster than a support ticket.

Worked example

A user reports being locked out for two days. The blocked account list is empty and the address list shows nothing — because the account had been disabled when they moved departments and their old role was closed. Two minutes in the right list, after twenty spent in the wrong ones.

Recommendations

• Check blocked, address and disabled — all three.
• Learn the blocked/disabled distinction and teach it to your service desk.
• Follow up repeatedly blocked accounts.
• Leave automatic blocks to expire unless somebody is waiting.