"I'm Locked Out" — What to Do

Getting locked out of your Microsoft 365 account can happen for several different reasons. This article helps you quickly identify why it happened and what to do about it — and since you're locked out, this page is designed to be bookmarked or printed so it's accessible without signing in.

 

🖨️  Tip: Print or save this article somewhere accessible without logging in.  On your phone, saved as a PDF, or posted near your workstation. You won't be able to look it up in the KB if you're fully locked out.

 

Step 1: Identify Your Lockout Type

Find your situation in the table below to get to the right fix fast:

 

	What you see	Why it happens	What to do
🔒	Account locked - too many failed attempts	Microsoft locks accounts after several wrong password entries to protect against attacks	Wait 15–30 minutes and try again, or use SSPR at aka.ms/sspr to reset your password immediately
📵	MFA device lost, broken, or replaced	Your Authenticator app is on a phone you no longer have access to	Contact IT or ask your franchise owner to reset your MFA via the My Staff portal. A coworker can submit the ticket.
🚫	Conditional access block — sign-in denied	You are signing in from a device or location that does not meet IT security policy	Try from a company-managed device or contact IT to verify whether your device/location is approved
⌛	Password expired	Your password reached its maximum age and must be changed	Go to aka.ms/sspr to reset it, or visit outlook.office.com - you will be prompted to change it on login
❓	"Something went wrong" — no clear reason	Session error, browser cache issue, or temporary Microsoft service issue	Clear your browser cache, try a private window, or try a different browser. Check Microsoft service status at aka.ms/m365status

 

Scenario 1: Too Many Failed Password Attempts

Microsoft automatically locks accounts after several incorrect password attempts. This is a security feature - it prevents attackers from guessing your password.

 

What to do

• Wait 15–30 minutes. The account will often unlock itself automatically.
• While waiting, do not keep trying to sign in - each failed attempt may extend the lockout.
• Once unlocked, reset your password immediately via aka.ms/sspr so it doesn't happen again.
• If you cannot wait or the account does not unlock, contact IT or ask your franchise owner to reset it via My Staff.

 

💡  Tip: If you're getting locked out repeatedly, your password may be saved incorrectly somewhere — check your phone's saved passwords, Outlook desktop, and any other app that uses your work account. Update them all after resetting.

 

Scenario 2: Lost, Broken, or Replaced MFA Device

If the phone with your Microsoft Authenticator app is lost, stolen, broken, or replaced, you will not be able to approve MFA prompts - and you will be locked out even if your password is correct.

 

What to do

1. Ask a coworker to contact IT on your behalf (or contact IT yourself from a personal device).
2. IT will need to verify your identity before resetting MFA - have your name, email, job title, and location ready.
3. Your franchise owner can also reset your MFA via the My Staff portal at mystaff.microsoft.com.
4. Once reset, you will need to set up Authenticator on your new device - see the Setting Up Microsoft Authenticator article.

 

🔴  If your phone was stolen: Report it to IT immediately. They can revoke all active sessions on your account so the thief cannot access your email, files, or apps even if your phone is unlocked. Do not wait!

 

✅  Prevention: Register a backup authentication method (SMS text or backup email) at aka.ms/mysecurityinfo while you still have access. This gives you an alternate way in if your Authenticator app is unavailable.

 

Scenario 3: Conditional Access Block

A conditional access block means IT's security policy is preventing your sign-in because something about your device, location, or network doesn't meet the required security standards.

 

Common causes

• Signing in from a personal device that is not enrolled in Intune / Company Portal
• Signing in from an unrecognized or untrusted network (e.g. a public Wi-Fi hotspot)
• Signing in from an unusual geographic location
• Your device's operating system is out of date and does not meet compliance requirements

 

What to do

• Try signing in from a company-managed device first - this resolves most conditional access blocks immediately.
• If you need access from a personal device, make sure the Intune Company Portal app is installed and enrollment is complete.
• If you are traveling or working remotely and are being blocked, contact IT - they can verify whether your location is the cause and assist with access.
• Do not use a VPN to try to bypass the block - this can trigger additional security flags on your account.

 

💡  Note: A conditional access block is not the same as being locked out due to a wrong password. Your password and account are fine — the sign-in is being blocked at the policy level. IT can review the exact policy triggered and help you resolve it.

 

Scenario 4: Expired Password

If your password has reached its maximum age, Microsoft will prevent sign-in until you set a new one.

 

What to do

• Go to aka.ms/sspr from any device and follow the self-service reset steps.
• Alternatively, go to outlook.office.com - if your password is expired, Microsoft will prompt you to change it right at the sign-in screen before letting you in.
• See the full Resetting Your Password article for step-by-step instructions and password requirements.

 

Scenario 5: "Something Went Wrong" - Unclear Error

Sometimes the sign-in fails without a clear reason. Before contacting IT, try these quick fixes in order:

 

5. Clear your browser cache and cookies (Chrome: Ctrl+Shift+Delete / Edge: Ctrl+Shift+Delete).
6. Open a private or incognito window and try signing in again.
7. Try a completely different browser (e.g. if you normally use Chrome, try Edge).
8. Check Microsoft's service status at aka.ms/m365status - if Microsoft is having an outage, there is nothing to do but wait.
9. Restart your computer and try again.
10. If none of the above works, contact IT.

 

🌐  aka.ms/m365status shows the real-time health of all Microsoft 365 services. If the sign-in service shows an incident or advisory, the issue is on Microsoft's end - not yours.

 

Contacting IT When You're Locked Out

Since you can't sign in, you cannot submit a help desk ticket yourself. Here are your options:

 

• Ask a coworker: Have them submit a ticket on your behalf. Give them the details below.
• Ask your franchise owner: They have access to the My Staff portal and can reset passwords and MFA without involving IT.

 

What to have ready when you contact IT

 

Have this ready	Why IT needs it
Your full name	To locate your account quickly
Your work email address	Primary account identifier
Your job title and location	To verify your identity
An alternate phone number	So IT can reach you since you can't receive account notifications
Description of what you see	The exact error message helps IT diagnose the issue faster
When it started	Helps IT check logs for the exact event that triggered the lockout

 

🔴  Security reminder: IT will NEVER ask for your current password. Identity verification is done through your name, role, location, and an alternate contact number. If anyone asks for your password, even someone claiming to be from IT, do not provide it and report the contact immediately.

 

Prevent Lockouts Before They Happen

Most lockouts are preventable. Take these steps now while you have access:

 

• Register two MFA methods: Go to aka.ms/mysecurityinfo and add both the Authenticator app and a backup phone number or email.
• Save the IT Help Desk number: Add it to your personal phone contacts so you can call even when locked out of work systems.
• Bookmark aka.ms/sspr: Save it on your personal phone or home computer so it's accessible if you're locked out on your work device.
• Update saved passwords: After any password change, update it in every app and device immediately to avoid repeated failed attempts triggering a lockout.
• Keep your OS and apps up to date: Outdated operating systems can trigger conditional access blocks. Enable automatic updates.

 

✅  The 2-minute setup that prevents most lockouts: Go to aka.ms/mysecurityinfo right now and make sure you have at least two authentication methods registered. That's it.

 

🛟  Need immediate help? Contact the IT Help Desk. If you cannot access your account, ask a coworker to submit a ticket on your behalf. Have your full name, work email address, and an alternate contact number ready.