Microsoft Account Locked? Unlock Personal and Microsoft 365 Accounts

“Microsoft account locked” can mean two different accounts with different fixes. A personal Microsoft account is the one behind Outlook.com, Hotmail, Xbox, OneDrive and Microsoft 365 Family or Personal. A work or school account is managed by your organization’s Microsoft 365 admin. The same address can exist as both, and the sign-in page may then ask which one you mean.

The exact wording tells you which lock you have, and the table below decodes each message. A pop-up or call about a lock that gives you a number to call is always a scam.

Which lock is it? Read the message

Personal Microsoft account: how to unlock it

1. On a device and network you normally use, type account.microsoft.com into the browser yourself rather than following a link, and sign in.
2. If the lock page offers Let’s prove you’re human, follow it: a quick check or a security code texted to a phone number you enter. Use a real mobile number, since Microsoft doesn’t send codes to VoIP numbers.
3. If that option isn’t there, Microsoft says the account was locked for suspicious activity or a Terms of Use issue. Use the aka.ms/ link in the lock window to request reinstatement; a Microsoft Online Safety agent reviews it and replies by email. Send it once, since extra requests slow the reply.

Once you’re back in, open account.microsoft.com/security and select Review activity; use This wasn’t me on unusual entries or Secure your account on recent ones you don’t recognize. Then change the password, confirm your security info is all yours, and check Sent Items for messages you never wrote.

Can’t get the code, or lost your phone

• Codes don’t arrive. Check junk mail for codes from an @accountprotection.microsoft.com address, allow texts from unknown senders, and switch between Wi-Fi and mobile data. Repeated code requests can get you blocked, temporarily or permanently, so pause instead of retrying.
• You lost one method but know the password. Sign in with a method you still have and replace the lost one. Don’t change all your security info at once, or Microsoft may restrict the account for 30 days.
• You lost every method but know the password. At the verification prompt choose I don’t have any of these and enter new security info. Microsoft then makes you wait 30 days, which also stops a stranger trying the same thing; signing in with an old method meanwhile cancels the change.
• You forgot the password too, or nothing works. Try Microsoft’s Sign-in helper, then the account recovery form, filled in from a device and place you’ve used before with every detail you can; wrong guesses don’t count against you. Any working email can take the reply, even a relative’s. Microsoft replies within 24 hours and allows two attempts a day.

One hard limit: if two-step verification was on and you can’t reach any verification method, Microsoft says it can’t help, so look for a recovery code you saved earlier.

Work or school account locked or blocked: get back in

Get back in yourself

1. Stop for a few minutes. Every failed attempt extends the lock.
2. Unsure of the password? Use self-service password reset: choose Can’t access your account? on the sign-in page, or go to aka.ms/sspr, then I forgot my password, which Microsoft says resets the lockout to zero. I know my password doesn’t reset the timer, so you’d have to change the password or wait it out.
3. Update the password in Outlook, Teams and any mail app on each phone and PC. If Outlook then keeps prompting, see Outlook keeps asking for password.

Self-service reset works only if your admin enabled it and you registered a method such as Microsoft Authenticator or a phone number. Otherwise you’ll see a Contact your administrator link, and an admin has to reset the password.

Why it locked

Microsoft Entra ID, the sign-in service behind Microsoft 365, locks an account after 10 failed sign-ins by default (three in US Government tenants). The first lock lasts one minute, and each further failure locks it for longer.

• Repeats of one wrong password don’t add up. Entra remembers the last three bad passwords, so a phone retrying one stale password is rarely the trigger; several different wrong guesses are. Offices using pass-through authentication to an on-premises server don’t get this tracking.
• Location has its own counter. Familiar and unfamiliar locations are counted separately, so an attacker abroad gets locked out while you keep working; when you travel, you can be the unfamiliar one.

Separately, Microsoft blocks sign-ins it judges malicious, whether or not the password is right, so a user can look locked out while under attack. Both this block and smart lockout show error AADSTS50053; the Failure reason in the sign-in logs tells them apart.

Blocked by an admin, or a password that expired

A blocked account isn’t a lockout: an admin deliberately stopped all sign-ins, typically when someone leaves or the account may be compromised. Waiting and self-service reset won’t help; only the admin can unblock it. An expired password isn’t a lock either; just change it at the prompt.

For Microsoft 365 admins: unlock, unblock and investigate

Unlock a locked-out user

You don’t have to wait out smart lockout: Microsoft says resetting the password unlocks a cloud account. In the Microsoft 365 admin center open Users > Active users, select the user, choose Reset password, decide whether they must change it at first sign-in, and confirm. The admin center no longer emails passwords, so pass it on by phone or in person once you’re sure it’s really that user.

Unblock sign-in

To unblock sign-in for a Microsoft 365 user, select them on the same page. A blocked account offers Unblock sign-in where an active one offers Block sign-in; open it, clear Block this user from signing in and save. Find out who blocked it and why first, and if it was a precaution, reset the password before unblocking.

If your users sync from an office server

If accounts sync from a Windows Server domain through Microsoft Entra Connect, Microsoft warns that an admin-center reset changes only the cloud password. Reset synced users in Active Directory Users and Computers, or in the Microsoft Entra admin center with password writeback, and clear a domain lockout there with Unlock account on the user’s Account tab.

If the lockouts look like an attack

Many failures on one account, or several staff locked out at once, usually means password guessing, often a spray of common passwords across every account.

1. Reset the password, then reopen the user and select Sign out of all sessions on the Account tab. Microsoft says they must sign in again within an hour; signing out another admin takes the Global Administrator role.
2. Right away, in the Microsoft Entra admin center under Entra ID > Users, open the user’s Authentication methods and look for a phone or app nobody recognizes. Delete it, or choose Require re-register MFA, which deletes the user’s phone numbers, Authenticator apps and software OATH tokens; otherwise an attacker’s method could reset the password again.
3. To stop everything, add Block sign-in, but Microsoft warns a block can take up to 24 hours to apply; the password reset works straight away.
4. Read Entra ID > Monitoring & health > Sign-in logs, filtered by user, the same day: Entra ID Free keeps sign-in and audit logs for seven days, P1 or P2 for 30. 50126 is a wrong password, 50053 a lockout or known-malicious IP, 50057 a blocked (disabled) account and 50055 an expired password. A 50074 or 50076 from somewhere your team has never been usually means the password was right and only MFA stopped the sign-in, so treat that password as known.
5. Check the mailbox for forwarding or deletion rules nobody created; our guide to signs a business has been hacked covers what else to look for.

Leave MFA, security defaults and Conditional Access on throughout; switching them off to rescue one user swaps an inconvenience for a breach. Custom lockout settings, under Entra ID > Authentication methods > Password protection, need Microsoft Entra ID P1 or higher, and the defaults suit most small offices.

Lockout scams: how to tell the real thing

Scammers copy Microsoft’s lock warnings because a locked account makes people act fast. A few checks expose them:

• Microsoft’s unlock steps happen on its sign-in page and online forms. None involve calling a number, installing remote-access software or paying a fee, and its error and warning messages never include a phone number.
• Microsoft doesn’t make unsolicited calls or send unsolicited messages offering support. Its agents act on a locked personal account only after you submit the reinstatement form, so anyone who contacts you first isn’t Microsoft.
• Microsoft says genuine security alerts come from account-security-noreply@accountprotection.microsoft.com. Even then, open account.microsoft.com yourself instead of clicking the link.
• A browser page claiming your PC or account is locked usually only needs closing. If it won’t close, end the browser in Task Manager and don’t restore the tabs.

Genuine IT help doesn’t arrive as a pop-up or a cold call. With us, you approve every remote session and can end it at any time, and no outside provider, us included, can lift a Microsoft lock on a personal account.

If you already let a caller connect, disconnect from the internet, uninstall every app they had you install and run a full scan with Windows Security or your antivirus; after longer access, back up your documents and consider resetting the PC. Change your passwords from another device, starting with email. If you paid or shared card details, call your card provider, and report the scam at microsoft.com/reportascam and reportfraud.ftc.gov.

Prevent the next lockout, and when to get help

• Personal accounts: keep at least two verification methods, such as Microsoft Authenticator or a passkey plus an alternate email (Microsoft is phasing out text codes for personal accounts), so one lost phone doesn’t mean the 30-day wait.
• Work accounts: register more than one method at mysignins.microsoft.com/security-info, and have your admin enable self-service password reset so most lockouts never need an admin. Changing phones? Move Authenticator first with our new-phone guide, and if approvals stop arriving, see Microsoft Authenticator not working.
• Admins: keep two admin accounts so one locked-out admin can’t shut the company out of its own settings.

If you’re the only admin and can’t sign in, try Forgot password on the sign-in page; self-service reset is on by default for admins and usually asks for two verification methods. If nobody can reach the admin center, say because the only admin was a former employee or IT provider, ask that person to make one of your staff an admin, or contact Microsoft Support for business, which can restore access once you prove the organization is yours.

Get help when lockouts return right after a reset, or when the logs show sign-ins from places your team has never been. If you’d like a technician to read the logs, reset the account and tighten MFA with you, that’s a typical $59 remote fix; setting up MFA and sign-in restrictions for every account is part of our Microsoft 365 support.

Common questions

How long does a Microsoft account stay locked?

It depends on the lock. A personal Microsoft account stays locked until you pass Microsoft’s unlock check or its review of your reinstatement request; there’s no published timer. A work account caught by smart lockout unlocks itself, starting after one minute and taking longer with each further failure. An account an admin blocked stays blocked until that admin unblocks it, however long you wait.

Why was my Microsoft account locked if I didn’t do anything wrong?

For personal accounts, Microsoft locks accounts when it sees activity such as spam or phishing, and that activity is often from someone who got hold of your password. For work accounts, a lockout usually means repeated wrong passwords, from you, an old device or an attacker trying to guess. Either way, change the password once you’re back in and check your recent sign-in activity.

Can Microsoft support unlock my account for me?

For a personal account, only through Microsoft’s own process. Its support agents won’t send reset links or change account details on request; for a locked account they act only after you submit the reinstatement form from the lock page, and a Microsoft Online Safety agent replies by email. A work or school account is unlocked by waiting, by self-service password reset or by your organization’s admin. If you’re the only admin and can’t sign in, contact Microsoft Support for business.

What’s the difference between a locked and a blocked Microsoft 365 account?

A locked account was stopped automatically by smart lockout after too many failed sign-ins, and it releases on its own or when the password is reset. A blocked account was stopped on purpose by an admin, usually because the person left or the account may be compromised. Confusingly, a blocked account’s message says it has been locked and to contact your support person. Only an admin can lift a block, from the user’s page in the Microsoft 365 admin center.

How do I unlock my Microsoft account without my phone?

For a personal account, use another method on file, such as an alternate email. If you have none but know your password, choose I don’t have any of these and accept Microsoft’s 30-day wait; if you’ve forgotten the password too, use the account recovery form from a device you’ve used before. For a work account, ask your admin to require re-registration of your MFA methods or issue a Temporary Access Pass; neither needs your phone.

Can my admin unlock my work account right away?

Yes. Microsoft says an admin can unlock a cloud account caught by smart lockout by resetting its password, without waiting for the lockout to expire. That’s done from Users > Active users in the Microsoft 365 admin center. If the account was blocked rather than locked, the admin unblocks sign-in from the same page, ideally after confirming the account hasn’t been compromised.