👥 Recipe · User & Group Management

Unlock a User Account in Entra ID / Microsoft 365

Restore sign-in access for a locked-out user by clearing smart lockout state, re-enabling the account, and validating access

Complexity

Beginner

Impact

user-management + identity + helpdesk + authentication + entra-id + microsoft-365

Context

Why This Matters

Users in Entra ID (formerly Azure AD) can become unable to sign in for several distinct reasons that all get colloquially called "locked out":

Smart lockout triggered by repeated bad password attempts — Entra ID temporarily blocks sign-ins from the offending source.
Account disabled (accountEnabled = false) — often set by a lifecycle policy, HR offboarding automation, or a prior admin action.
Risky user state in Identity Protection — Entra has flagged the account and is blocking sign-ins until risk is remediated.
Password expired or MFA registration incomplete.

This recipe covers the standard unlock workflow an IT admin runs when a user (e.g. AlexW@contoso.onmicrosoft.com) calls the help desk saying they can't sign in. It walks through diagnosing the lockout cause, clearing it, and confirming the user can sign in again.

Expected Outcomes

After completing this recipe you will have:

Identified the specific reason the user cannot sign in (smart lockout, disabled account, risk state, or expired credential).
Re-enabled the account and/or dismissed the risky-user state as appropriate.
Optionally reset the password and issued a Temporary Access Pass (TAP) if the user has forgotten their credentials.
Revoked existing refresh tokens so stale sessions on compromised devices cannot be reused.
Confirmed with the user that sign-in succeeds.
An audit trail entry in the Entra audit log showing who performed the unlock and when.

Risks & Considerations

Verify the requester's identity before unlocking. Account-unlock social engineering is one of the most common help-desk attack vectors. Require a secondary verification channel (Teams video call, manager confirmation, or a pre-registered callback number) before clearing lockout or resetting a password.

Do not dismiss risk without investigation. If Identity Protection flagged the user, check sign-in logs for suspicious IPs or impossible-travel events. Clearing risk blindly can leave an attacker with valid access.
Revoke sessions after a password reset. A reset alone does not invalidate existing refresh tokens. Always run a session revocation if there is any suspicion of compromise.
Smart lockout clears on its own. The default Entra smart-lockout duration is 60 seconds and scales with repeated bad attempts. There is no direct "unlock smart lockout" API — you reset the password or wait it out.
Federated accounts (synced from on-premises AD) must be unlocked in on-prem AD, not in Entra. Check onPremisesSyncEnabled first.
Privileged accounts (Global Admin, Privileged Role Admin) require extra scrutiny and should be unlocked by a second admin under the four-eyes principle.

Required Permissions

Permission	Why It's Needed
User.ReadWrite.All	Required to update the accountEnabled property and reset passwords via Graph API.
UserAuthenticationMethod.ReadWrite.All	Required to issue a Temporary Access Pass or reset authentication methods.
IdentityRiskyUser.ReadWrite.All	Required to dismiss or confirm-safe a risky user flagged by Identity Protection.
AuditLog.Read.All	Required to inspect recent sign-in failures to diagnose the lockout cause.
Directory.AccessAsUser.All	Needed for delegated scenarios where the admin acts through the portal or Graph Explorer.

The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.

For IT Admins

Paste into Dex Pro

{user} is locked out of Microsoft 365 and can't sign in. Investigate the cause (smart lockout, disabled account, risky-user state, or expired password), remediate appropriately, reset the password or issue a Temporary Access Pass if needed, revoke their existing sessions, and confirm sign-in is restored.

Try in Dex Pro

For End Users

How an employee would ask Dex for help

I can't sign in to my Microsoft 365 account — it says my account is locked. Can you help me get back in?

Try in Dex Playground

Unlock a user via the Microsoft Entra admin center

Step 1 — Locate the user

Sign in to https://entra.microsoft.com as a User Administrator or higher.
Navigate to Identity → Users → All users.
Search for the user by UPN (e.g. AlexW@contoso.onmicrosoft.com) and open their profile.

Step 2 — Diagnose the cause

On the user's overview blade, check the Account enabled field. If it reads No, the account is disabled.
Click Sign-in logs in the left pane of the user profile. Review the most recent failed sign-ins and note the Failure reason column — common values include 50053 (account locked), 50057 (account disabled), 50055 (password expired), and 53003 (blocked by CA policy).
Go to Protection → Identity Protection → Risky users and search for the user. If present with risk state At risk, Identity Protection is blocking sign-ins.

Step 3 — Re-enable the account (if disabled)

Return to the user profile and click Edit properties.
Under the Settings section, toggle Account enabled to Yes.
Click Save.

Step 4 — Reset the password (if needed)

On the user overview, click Reset password at the top of the blade.
Entra will generate a temporary password. Deliver it to the user through a verified out-of-band channel (not the same email they cannot access).
Leave Require this user to change their password when they first sign in checked.

Step 5 — Issue a Temporary Access Pass (preferred for passwordless users)

From the user profile, select Authentication methods → Add authentication method → Temporary Access Pass.
Configure duration (default 1 hour) and whether it is one-time use.
Copy the TAP and deliver it through a verified channel.

Step 6 — Dismiss risk (if flagged)

Go to Protection → Identity Protection → Risky users.
Select the user, click Confirm user safe if you have verified the sign-in failures were legitimate, otherwise click Confirm user compromised and follow the compromise playbook.

Step 7 — Revoke sessions and confirm access

Back on the user profile, click Revoke sessions. This invalidates all refresh tokens.
Ask the user to sign in. Confirm success in Sign-in logs.

Unlock a user via Microsoft Graph API

All examples use the v1.0 Graph endpoint. Replace {user-id} with the user's object ID or UPN.

1. Check the user's current state

GET https://graph.microsoft.com/v1.0/users/{user-id}?$select=id,userPrincipalName,accountEnabled,onPremisesSyncEnabled
Authorization: Bearer {token}

If onPremisesSyncEnabled is true, stop — this user is mastered in on-prem AD and must be unlocked there.

2. Review recent sign-in failures

GET https://graph.microsoft.com/v1.0/auditLogs/signIns?$filter=userPrincipalName eq '{upn}' and status/errorCode ne 0&$top=10&$orderby=createdDateTime desc

3. Re-enable the account

PATCH https://graph.microsoft.com/v1.0/users/{user-id}
Content-Type: application/json

{
  "accountEnabled": true
}

Expected response: 204 No Content.

4. Reset the password

PATCH https://graph.microsoft.com/v1.0/users/{user-id}
Content-Type: application/json

{
  "passwordProfile": {
    "forceChangePasswordNextSignIn": true,
    "password": "{temporary-password}"
  }
}

5. Issue a Temporary Access Pass

POST https://graph.microsoft.com/v1.0/users/{user-id}/authentication/temporaryAccessPassMethods
Content-Type: application/json

{
  "lifetimeInMinutes": 60,
  "isUsableOnce": false
}

The response body contains the temporaryAccessPass string — capture it and deliver securely.

6. Dismiss Identity Protection risk (if needed)

POST https://graph.microsoft.com/v1.0/identityProtection/riskyUsers/dismiss
Content-Type: application/json

{
  "userIds": ["{user-id}"]
}

7. Revoke all sign-in sessions

POST https://graph.microsoft.com/v1.0/users/{user-id}/revokeSignInSessions

Response: { "value": true } indicates all refresh tokens were invalidated.

Unlock a user with Microsoft Graph PowerShell

The Microsoft Graph PowerShell SDK wraps the same Graph endpoints shown above. Install once with Install-Module Microsoft.Graph -Scope CurrentUser.

Connect with the right scopes

Connect-MgGraph -Scopes "User.ReadWrite.All","UserAuthenticationMethod.ReadWrite.All","IdentityRiskyUser.ReadWrite.All","AuditLog.Read.All"

Inspect the user

$user = Get-MgUser -UserId "AlexW@contoso.onmicrosoft.com" -Property Id,UserPrincipalName,AccountEnabled,OnPremisesSyncEnabled
$user | Format-List

If OnPremisesSyncEnabled is True, stop — the account is synced from on-prem AD. Unlock it with Unlock-ADAccount on a domain controller instead.

Re-enable the account

Update-MgUser -UserId $user.Id -AccountEnabled:$true

Reset password and force change at next sign-in

$tempPwd = "Winter-Sprout-42!"  # generate randomly in production
Update-MgUser -UserId $user.Id -PasswordProfile @{
    ForceChangePasswordNextSignIn = $true
    Password = $tempPwd
}

Issue a Temporary Access Pass

$tap = New-MgUserAuthenticationTemporaryAccessPassMethod -UserId $user.Id -LifetimeInMinutes 60 -IsUsableOnce:$false
Write-Host "TAP: $($tap.TemporaryAccessPass)"

Dismiss risk and revoke sessions

Invoke-MgDismissRiskyUser -UserIds @($user.Id)
Revoke-MgUserSignInSession -UserId $user.Id

All actions above are written to the Entra audit log with your admin identity as the actor.

Next steps

More User & Group Management recipes

Browse the rest of this category in the Dex Cookbook.

Automate this with Dex Pro

Let the autonomous IT engineer run this task under your policies.

Start free

Point Dex at a tenant and try it for 30 days, no credit card.