Does "Forgot Password" reset an account lockout?

(0) Share

Report

Posted on by DianePana

I am having trouble finding a clear answer to this question. If one of my customers has failed to log in to a portal, and triggered a lockout on their account, can they reset the timer on the lockout by using the Forgot Password/Password Reset feature? When I've tested, I can reset my password but then my account is still locked out.

The description from this website makes it sound like resetting my password should also reset the lockout. Is that correct?

https://rishandigital.com/power-pages/user-locked-out-after-multiple-failed-attempts/

Navigate to Portal Management > Forms.
Enable the password reset feature for your portal, which will allow users to reset their passwords after being locked out due to failed attempts.
Configure the flow for email verification and password recovery, ensuring that users can regain access quickly without having to contact support.

Categories:

Power Apps portals

Security

I have the same question (0)

All responses (6)

Answers (0)

Suggested answer

oliver.rodrigues 9,425 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

What is the identity provider that you have setup in the system?

If you are using Entra External ID, for example, it would naturally reset the user when they get to lockout after a few hours (I think the default is 2 hours)

Was this reply helpful? Yes No
DianePana 11 on at

Like (0)

Report
Copy link

Link copied!

@oliver.rodrigues My question is not about the time limit on the lockout, I am aware that that a lockout will expire after a certain amount of time. I'm asking about the Forgot Password feature. If a user resets their password using that, while their lockout is active, does it cancel the lockout?

Was this reply helpful? Yes No
Suggested answer

oliver.rodrigues 9,425 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Which authentication method are you using?

Are you using local authentication? entra external id? entra id? open id? azure ad b2c? any other?

Was this reply helpful? Yes No
DianePana 11 on at

Like (0)

Report
Copy link

Link copied!

@oliver.rodrigues The site uses local authentication. A different site I maintain uses OpenID authentication, and using the "forgot password" functionality does completely remove the lockout if you triggered it before trying to reset your password.

Was this reply helpful? Yes No
Suggested answer

oliver.rodrigues 9,425 Most Valuable Professional on at

Like (0)

Report
Copy link

Link copied!

Thanks, ultimately this process is managed by the following Action:

You can add that process to your solution and make changes to manage the user lockout where needed.

On another note, the local authentication is deprecated and you should look into moving the authentication to Entra External or other providers.

Was this reply helpful? Yes No
DianePana 11 on at

Like (0)

Report
Copy link

Link copied!

The password reset process is working just fine. What it isn't doing, is unlocking the user's account after they reset the password. Is that not available when using local authentication?

(I do want to migrate to a non-deprecated authentication mechanism, but this portal is critical and changes happen...slowly.)

Was this reply helpful? Yes No