> ## Documentation Index
> Fetch the complete documentation index at: https://docs.elementum.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Account Lockout

> How Elementum protects accounts from brute-force attacks and how locked users can restore access without contacting support.

## Overview

After 5 consecutive failed login attempts, Elementum automatically locks the account and rejects all further login attempts. To restore access, the user must click **Forgot Password** on the login screen and complete a password reset. This unlocks the account -- no support ticket or admin intervention required.

This policy applies to password-based login only. Users who authenticate through an Identity Provider via [SSO/SAML](/administration/sso-saml-setup) are governed by their IdP's own lockout and recovery policies.

***

## User recovery

When locked out, go to the Elementum login page and click **Forgot Password**, then follow the password reset flow:

1. Enter the registered email address and click **Send Reset Link**.
2. Open the reset email and click the link.
3. Enter and confirm a new password, then click **Reset Password**.

The account is unlocked immediately. No further action is required.

<Warning>
  Password reset links are single-use and expire after a short period. If the link has expired, return to the login page and request a new one.
</Warning>

***

## Admin visibility

Org Admins can see when a user is locked from the **Users** page in Organization Settings. A lock icon appears in the **Locked** column next to any user whose account is currently locked.

Locked accounts are visible for troubleshooting, but admins cannot manually unlock an account -- recovery is handled exclusively through the password reset flow to ensure the account owner is the one regaining access.

***

## Related features

<CardGroup cols={2}>
  <Card title="Multi-Factor Authentication" icon="shield-check" href="/administration/multi-factor-authentication">
    Add a second factor to login so a compromised password alone is not enough to gain access
  </Card>

  <Card title="SSO & SAML" icon="key" href="/administration/sso-saml-setup">
    Centralize authentication through your Identity Provider, which manages its own lockout policies
  </Card>

  <Card title="Users" icon="user" href="/administration/users">
    View and manage user statuses, including Locked accounts, from the admin console
  </Card>

  <Card title="External User Re-Authentication" icon="rotate" href="/administration/external-user-reauth">
    Require external users to periodically re-verify their identity via magic link
  </Card>
</CardGroup>