> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Account Unlock
> Turns sign-in back on for a blocked account in your client's Microsoft 365, or enables and unlocks an AD-synced account in Active Directory.
Account Unlock lets a blocked user sign in again. Use it when someone's account has been blocked from signing in, for example while they were away. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365), and the [desktop agent](/desktop-agent/overview) for a client that syncs on-premises Active Directory.
## What the form asks
| Field | |
| - | - |
| User | Required, always on. The account to unlock, picked from the client's users. Blocked and unlicensed accounts are listed |
| Reason / ticket reference | Optional by default. For your records and the approver; not sent to Microsoft |
## What it does
1. Creates a ticket in your PSA, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External, or a conditional override matches.
3. Re-enable Sign-in: turns sign-in back on for the account in the client's Microsoft 365.
For an AD-synced account on a client that syncs on-premises AD, Set On-Prem Account State runs instead: the desktop agent enables and unlocks the account in Active Directory, then starts a delta sync if it runs on the Microsoft Entra Connect server. Cloud-only accounts on that client take Re-enable Sign-in. If the Active Directory change fails, the run stops with the error.
With Log actions to the ticket on, the ticket also gets a note when the run starts, after Re-enable Sign-in and when the run completes.
## Configure it
Go to **Config** and click Account Unlock.
| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| User | Form config | Always on: the automation needs it |
| Reason / ticket reference | Form config | Hidden, Optional or Required. Can differ per client |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates, but aren't sent to Microsoft. Add client section asks one client only |
| Approval | Approval | None runs on submit. Internal waits for a teammate or group; External waits for the client's approver, set on each client. Conditional overrides use a different approval when the answers match |
| Ticketing | Ticketing | Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |
| User directory filters | User directory filters | Which users the User picker lists. Here Licensed users only and Active users only start unticked, so blocked and unlicensed accounts are listed; keep Active users only unticked. Exclude members of Entra roles you add (for example Global Administrator), and exclude specific users at a client's scope |
Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).
## Troubleshooting
Check User directory filters for that client. With **Active users only** ticked, accounts whose sign-in is blocked are hidden. Guests and anyone in an Entra role you've excluded are hidden too.
Account Unlock turns sign-in back on. It doesn't change Microsoft Entra [smart lockout](https://learn.microsoft.com/en-us/entra/identity/authentication/howto-password-smart-lockout) after repeated wrong passwords, which ends on its own. For an AD-synced account, Microsoft 365 picks up the change at the next Entra Connect sync. If they've forgotten their password, run [Password Reset](/core/workflows/password-reset).
This ticket note means the desktop agent couldn't enable or unlock the account in Active Directory. The note includes the error. Make the change in Active Directory, or fix the cause and run it again.
## Related
* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [Executions](/core/use/executions)
* [Password Reset](/core/workflows/password-reset), for a forgotten password
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.