Support / SUP-1144
Parcelwise: will ACME lock accounts after failed sign-ins?
Description
Our auditor asked if ACME locks accounts after failed sign-ins. After last night I assume not? Is it coming?
Linked issues
- relates to ENG-1702 Sign-in lockout and rate limits Done
Comments (4)
Femke de Boer · 3 Sep 2026, 09:30 UTC
OK, please let me know when it's live so I can tell the auditor.
Mira Holm · 10 Sep 2026, 09:05 UTC
Live this morning:
- ten failed passwords within 15 minutes lock that account's password sign-in for 15 minutes
- your administrators get a notice in the portal and can unlock someone sooner
- attempts from one internet address are limited at the edge
- phone codes keep their own limit: five tries per code, then a 15-minute wait
- sign-ins through Entra ID are left to Entra ID
Femke de Boer · 10 Sep 2026, 09:30 UTC
Thanks!
Hi Femke, not yet, and you're right to ask. Account lockout and limits on attempts from one address are being built now and should be live next week. Your hubs sign in through Entra ID, so lockout will only matter for the few accounts with ACME passwords.