When it's already happened
Locked out of your work account? Here's what to try
You cannot get in, you may be late for something, and your heart rate is up. Here is the calm ordered checklist of what actually causes this, the self-service routes that fix it in three minutes when your employer allows them, what to do when the multi-factor app is the real blocker, and exactly what to tell the helpdesk so it takes one message instead of five.
Three careful attempts, then stop, because extra tries are what lock the account. Work the list in order, and when you contact the helpdesk, lead with your username, the exact error text, and a phone number that reaches you while you are locked out.
Last reviewed 2026-08-18 by Grayson Dodson. Free, plain-English guidance for everyday work technology.
What you'll be able to do
work through the real causes of a lockout in order, use the self-service reset routes where your employer has enabled them, clear the old password out of the devices that keep re-locking you, and give the helpdesk the five details that get it fixed in one round trip
caps lock, keyboard layout andexpired passwordaccount lockout thresholds, and whyself-service password reset at aka.ms/sspr,cached old passwords that keepmulti-factor method reset, recovery codesthe five details that getidentity verification before a reset,
First, this is routine, and the fix is usually small
Being locked out is the single most common thing helpdesks deal with, every day, in every organization. Nobody keeps a list of who it happened to. It is not a mark against you and it is not evidence that you did something wrong. So before anything dramatic, run the twenty-second checks, because they solve a surprising share of these. Caps Lock first, since a password typed in capitals fails silently. Then the keyboard layout indicator in the bottom right corner of the Windows sign-in screen: if it shows a language you do not type in, the @ symbol and the quote marks have swapped places. Then the account itself, which needs to be your full work address, firstname.lastname@company.com, rather than the personal Gmail your browser cheerfully filled in. Click the small eye icon at the right of the password box and read what you actually typed, as long as nobody is standing behind you. Then stop. Do not keep hammering the same password, because repeated attempts are exactly what turn a wrong keystroke into a locked account. Three slow, careful tries is the right number, and then you move on to the list below.
The six things that actually cause this
There is a short list, and your situation is almost certainly on it. One, your password expired. Many employers still force a change every sixty or ninety days, and Windows says so plainly with a message about your password having expired, while Microsoft 365 in a browser shows the code AADSTS50055. Two, too many attempts locked the account, and this often clears itself. Microsoft Entra ID's smart lockout starts at around ten bad attempts, with a lockout of roughly a minute that grows longer each time, while older on-premises Active Directory setups commonly use fifteen or thirty minutes. Genuinely, a coffee break sometimes fixes it. Three, you changed your password recently and something is still offering the old one. Four, you are on a new or rebuilt computer that has not been enrolled yet, so it cannot reach the directory that knows you. Five, your multi-factor app lives on a phone you replaced, so the password is fine but you cannot finish signing in. Six, the account is genuinely disabled, which shows as AADSTS50057 and usually traces back to a leave date, a contract end, or an HR record that changed.
The self-service routes, and the honest caveat about them
If your employer has switched it on, you can often fix this yourself in three minutes. For Microsoft 365 and Entra ID accounts the address is aka.ms/sspr, which lands you on passwordreset.microsoftonline.com. You type your work address, pass a check by text message, phone call or the Microsoft Authenticator app, and set a new password. For Google Workspace, go to accounts.google.com, enter your work address, and use the Forgot password link on the sign-in page. If your company signs you in through Okta, the same idea sits under Forgot password on your company's own page, usually something like yourcompany.okta.com. Do all of this from a device that still works, which normally means your phone on mobile data or a home computer, because the laptop that is locked out is the worst place to try. Now the honest part. Plenty of employers turn self-service reset off deliberately, and Google Workspace administrators frequently disable password recovery for ordinary staff, because a reset flow is also a door an attacker can walk through. If the page tells you your organization has disabled this, that is a policy decision, not you doing it wrong. Go straight to the helpdesk.
When your password is right but something keeps re-locking you
Here is the case that drives people to despair: you reset your password successfully, and twenty minutes later you are locked out again. That almost always means some device is still cheerfully offering the old password on a loop until the account trips its lockout. The usual culprits are your phone's mail app, a mapped network drive, a saved VPN profile, or an old session in Outlook. Fix it by hunting down each stored copy. On your phone, remove and re-add the work account, in Outlook mobile under Settings and the account name, or under iOS Settings, Apps, then Mail, then Mail Accounts. On Windows, open Control Panel, User Accounts, then Credential Manager, choose Windows Credentials, and remove the stale entries for your work server. On a Mac, open the Keychain Access app and delete the saved work password there. One more that catches remote workers: with a Windows domain account changed while you were away from the office, sign in using the old cached password, connect the VPN, then press Ctrl+Alt+Delete, lock the screen, and unlock it with the new password so the laptop finally learns it.
When multi-factor is the blocker, not the password
Sometimes the password sails through and the second step is what stops you. If the old phone is still in a drawer, the easiest path is the backup built into the app. Microsoft Authenticator can restore from cloud backup if you had it turned on and you sign back in with the same personal Microsoft account, and Google Authenticator now syncs codes to your Google Account. Be ready for a work account to need re-verifying anyway, because employers often tie registration to one specific device on purpose. If you saved recovery codes, this is the moment they earn their keep: Google's live at myaccount.google.com under Security, then 2-Step Verification, listed as backup codes. If you can get in and simply need to add the new phone, do it at aka.ms/mfasetup for Microsoft, or the same 2-Step Verification page for Google. If none of that works, IT resets the method, and expect to prove who you are first: a video call so they can see your face, a callback on the mobile number in the HR system, or your manager confirming it is you. That check is guarding your account against someone impersonating you, so it is a good sign, not an insult.
What to tell the helpdesk so it is fixed in one message
Most of the back-and-forth happens because the first message says only that something is not working. Send these five things instead and you usually get one reply that fixes it. Your username in full, written out as firstname.lastname@company.com. The exact error, copied word for word, including any code such as AADSTS50053 or a line like your account has been locked out; a phone photo of the screen is perfect. What you already tried, so nobody sends you around the same loop: I tried aka.ms/sspr and it said self-service reset is not enabled. Where you are and what you are on, since a locked laptop at home over VPN is a different problem from a desktop in the office. And a contact method that works while you are locked out, which means your personal mobile number, because email will not reach you. Add a real deadline if you have one, such as a client call at eleven. Then be honest about what happened, including the part where you tried the same password eight times. Nobody is grading you. This is the errand they run all day, and the only thing that slows it down is missing information.
Common questions
How long does a work account stay locked out?
Often less time than you fear, and many lockouts clear themselves. Microsoft Entra ID's smart lockout typically starts at about a minute after roughly ten bad attempts, and lengthens with each further burst, while older on-premises Active Directory setups commonly use fifteen or thirty minutes. Your employer sets the number, so nobody outside your company can tell you exactly. The practical move is to stop trying, wait twenty or thirty minutes without touching it, then attempt once, slowly. If it still fails, the cause is something else, most likely an expired password or a device still offering the old one.
I forgot my work password, can I reset IT myself?
Sometimes, and it takes about three minutes where your employer allows it. For Microsoft 365 accounts go to aka.ms/sspr, enter your work address, verify by text, phone call or the Microsoft Authenticator app, and choose a new password. For Google Workspace use the Forgot password link at accounts.google.com. Do it from your phone or a home computer rather than the locked laptop. Many organizations switch self-service reset off on purpose, because the same flow can be abused by an attacker. If you see a message saying your organization has disabled this, that is policy, and the helpdesk is your route.
Why does my work account keep locking itself every few minutes?
Because something is still using your old password on a loop. After a password change, any device holding the previous one keeps retrying until the account trips its lockout again. Check your phone's mail account first, then mapped network drives, saved VPN profiles and old Outlook sessions. On Windows, open Control Panel, User Accounts, Credential Manager, then Windows Credentials, and remove the stale work entries. On a Mac, delete the saved work password in Keychain Access. Removing and re-adding the work account on your phone usually ends it. Tell IT as well, because their logs show which device is doing it.
I got a new phone and now I can't log into my work account, what do I do?
The password is probably fine; the missing piece is your multi-factor method. If Microsoft Authenticator cloud backup was switched on, sign back in with the same personal Microsoft account to restore it, and Google Authenticator now syncs codes to your Google Account. Expect a work account to need re-verifying anyway, since employers often bind registration to one device. Saved recovery codes work here too, and Google's live at myaccount.google.com under Security, then 2-Step Verification. Otherwise ask IT to reset the method. They will confirm who you are by video call, a callback, or your manager, which is your account being protected.
Will I get in trouble for getting locked out of my work account?
No. Lockouts are the most routine ticket a helpdesk handles, and clearing one is a two-minute job they do dozens of times a day. Nobody keeps a scoreboard. What does cause friction is different: retrying the same password until the account locks again, or borrowing a colleague's login to get the work done, which genuinely does breach most acceptable-use policies and creates a real problem where none existed. Say plainly what happened, including that you tried several times. If lockouts keep recurring, that is a technical fault worth reporting, not a mark against you.