Field note: why one user kept getting locked out

One user at a small business kept getting locked out of her account, sometimes several times a day. She wasn’t mistyping anything. No old phone was trying a stale password. Every time IT unlocked her, it happened again.

What was really happening

Her email address was being hit by a password spray: automated attempts from the internet trying common passwords against Microsoft 365 accounts. None of the guesses were right, but each failed attempt still counted against her account.

The reason it caused lockouts came down to how the office connected its on-premises Active Directory to Microsoft 365. The sync was set up with pass-through authentication (PTA), which sends cloud sign-in attempts to the office’s domain controllers to check the password. So every bad guess from the internet landed on the local domain controllers as a failed sign-in, and enough of them tripped the domain’s lockout policy.

The fix

We switched the sync from pass-through authentication to password hash sync (PHS). With password hash sync, Microsoft 365 checks sign-ins in the cloud itself, where Microsoft’s own protections, including its smart lockout feature, deal with spray attempts. The garbage attempts stopped reaching the office’s domain controllers, and the lockouts stopped.

We left the pass-through authentication agents installed on the server for a while, as a way to switch back quickly if anything went wrong.

What I took away from it

• Repeated lockouts with no user error usually mean someone else is trying the password. Check the sign-in logs for where attempts come from.
• How you connect AD to Microsoft 365 decides where failed cloud sign-ins land. With pass-through authentication, internet noise can become on-premises lockouts.
• Keep a rollback path when changing how people sign in, and test with one user before everyone.
• MFA matters here too. A spray that gets lucky still can’t get in without the second step. See turn on two-step sign-in.