How to find locked out accounts in Microsoft Entra ID

Before you start

Use an account with a role that can read the sign-in logs. Reports Reader is the least privileged; Global Reader, Security Reader, Security Operator and Security Administrator work too. Reading the logs with Microsoft Graph needs Microsoft Entra ID P1 or P2, while the admin centre shows them on every edition. The PowerShell example requests AuditLog.Read.All; your organisation may require administrator consent.

Know how smart lockout counts. It keeps separate counts for familiar and unfamiliar locations, doesn't count the same wrong password twice, and locks the account again after each further failure, for longer each time. Entra ID keeps sign-ins for 30 days with P1 or P2 and 7 days without. The examples read and export; they don't unlock or change any account.

Option 1

Find locked out accounts with PowerShell

Install the modules once, then connect and export the sign-ins of the last 7 days that returned error 50053. The filter runs in Microsoft Graph, so only those sign-ins come back.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication, Microsoft.Graph.Reports -Scope CurrentUser

$ErrorActionPreference = 'Stop'
$days = 7
$since = (Get-Date).ToUniversalTime().AddDays(-$days).ToString('yyyy-MM-ddTHH:mm:ssZ')
Connect-MgGraph -Scopes 'AuditLog.Read.All' -NoWelcome
try {
    $filter = "createdDateTime ge $since and status/errorCode eq 50053"
    $locked = @(Get-MgAuditLogSignIn -All -Filter $filter)
    if ($locked.Count -eq 0) {
        Write-Output "No sign-in returned error 50053 in the last $days days."
    } else {
        $locked | Select-Object CreatedDateTime, UserPrincipalName, AppDisplayName, IPAddress,
            @{ Name = 'FailureReason'; Expression = { $_.Status.FailureReason } },
            @{ Name = 'Country'; Expression = { $_.Location.CountryOrRegion } } |
            Export-Csv -Path './locked-sign-ins.csv' -NoTypeInformation -Encoding utf8
        $accounts = @($locked | Group-Object UserPrincipalName | ForEach-Object {
            $last = $_.Group | Sort-Object CreatedDateTime | Select-Object -Last 1
            [pscustomobject]@{
                Account     = $_.Name
                Lockouts    = $_.Count
                LastLockout = $last.CreatedDateTime
                LastAddress = $last.IPAddress
            }
        })
        $accounts | Sort-Object Lockouts -Descending |
            Export-Csv -Path './locked-accounts.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($locked.Count) locked sign-ins for $($accounts.Count) accounts."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The first file has every sign-in that returned 50053, the second 1 row per account, the most lockouts first. FailureReason tells a locked account from a blocked address. Lockouts from countries or addresses the person never uses point to someone guessing the password. Raise $days to read further back, up to the retention period.

Check 1 account

Reconnect with Connect-MgGraph, then read 1 person's most recent lockouts.

# Run while connected to Microsoft Graph. Replace the example account.
$filter = "userPrincipalName eq 'person@example.com' and status/errorCode eq 50053"
Get-MgAuditLogSignIn -Filter $filter -Top 10 |
    Select-Object CreatedDateTime, AppDisplayName, IPAddress,
        @{ Name = 'Reason'; Expression = { $_.Status.FailureReason } }

Option 2

Review lockouts in the admin centre

1. Sign in to the Microsoft Entra admin centre as at least a Reports Reader.
2. Go to Entra ID > Monitoring & health > Sign-in logs.
3. Select Failure from the Status menu, and search by username to narrow the list to the person.
4. Select a failed sign-in and read the Sign-in error code and Failure reason. Code 50053 with a reason that says the account is locked is a lockout.
5. Close the details without changing anything.

This suits 1 person who can't sign in right now. The log lists 1 sign-in per row, so for every account locked across a week, use PowerShell or a report.

Common questions

How long does a lockout last?

1 minute at first, and longer after each further lockout; Microsoft doesn't publish the rate. The defaults are 10 failed attempts and 60 seconds, 3 attempts in US Government tenants. An Authentication Policy Administrator can read them under Entra ID > Authentication methods > Password protection, and changing them needs Microsoft Entra ID P1.

How does the person get back in?

By waiting, or with self-service password reset: choosing I forgot my password sets the lockout to 0 seconds, while I know my password leaves the timer running. An administrator can also unlock the account by resetting its password.

Is every error 50053 a locked account?

No. Entra ID also returns it for a sign-in from an IP address with malicious activity, whatever the password. Read the failure reason of each, and for every other kind of failure, see how to find failed sign-ins.