Skip to main content
Account Unlock lets a blocked user sign in again. Use it when someone’s account has been blocked from signing in, for example while they were away. It needs Microsoft 365 connected, and the desktop agent for a client that syncs on-premises Active Directory.

Account Unlock in 49 seconds: what it asks, what it does and what you get.

​
What the form asks

​
What it does

  1. Creates a ticket in your PSA, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
  3. Re-enable Sign-in: turns sign-in back on for the account in the client’s Microsoft 365.
For an AD-synced account on a client that syncs on-premises AD, Set On-Prem Account State runs instead: the desktop agent enables and unlocks the account in Active Directory, then starts a delta sync if it runs on the Microsoft Entra Connect server. Cloud-only accounts on that client take Re-enable Sign-in. If the Active Directory change fails, the run stops with the error. With Log actions to the ticket on, the ticket also gets a note when the run starts, after Re-enable Sign-in and when the run completes.

​
Configure it

Go to Config and click Account Unlock.

Configure Account Unlock: every option, step by step (1:16).

Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

​
Troubleshooting

Check User directory filters for that client. With Active users only ticked, accounts whose sign-in is blocked are hidden. Guests and anyone in an Entra role you’ve excluded are hidden too.
Account Unlock turns sign-in back on. It doesn’t change Microsoft Entra smart lockout after repeated wrong passwords, which ends on its own. For an AD-synced account, Microsoft 365 picks up the change at the next Entra Connect sync. If they’ve forgotten their password, run Password Reset.
This ticket note means the desktop agent couldn’t enable or unlock the account in Active Directory. The note includes the error. Make the change in Active Directory, or fix the cause and run it again.