If you are locked out
What to try first when you cannot sign in, which methods can stand in for each other, and how account recovery starts.
On this page
Being locked out almost always has a way back. This page helps you find the shortest one. The full recovery procedure is covered in the sign-in section of this book, and this page tells you when to reach for it.
First, check the simple things#
| Symptom | Try this |
|---|---|
| The page says Too many attempts. Try again in a wait such as 45 seconds, 57 minutes or 2 hours. | Wait that long. There is no permanent lock from too many tries, only a delay. If it keeps happening, the platform may also email you about a burst of failed sign-in attempts. |
| The passkey did not work. Try again or use another method. | Try once more, then use another method your account has. |
| This browser cannot use passkeys here. Use another method. | Use a different browser, or your password, or an emailed link. |
| This sign-in has ended | Too much time passed. Select Start a new sign-in. |
| An emailed link or code does not work | Use it in the same browser where you asked for it, before it expires. Ask for a new one if needed. A link works once. |
| This link is not valid any more. | Ask for a new one. |
| An email says a sign-in was blocked because it looked risky | Try again from a browser you have used before, or add a passkey. |
Use another method you already have#
Methods can stand in for each other. Before you start recovery, see whether one of these is within reach.
| You lost | What can stand in |
|---|---|
| A device with your passkey | Your password: it always signs you in. On a browser the account already uses it is enough; on a new one choose Continue with my password only (limited session), then confirm later with another method. Or a passkey that is also on another device, your authenticator app or a recovery code, if you set them up. If a passkey is your only second step, type your password and choose Email me a code instead on the second step: it signs you in one level lower than a passkey, and your other addresses are told. The link I lost my passkey on that screen starts recovery with your address filled in. |
| Your password | A passkey, or Email me a sign-in link (an account that has a passkey and no authenticator app is refused an emailed link or code, so use the passkey). |
| Your authenticator app | One of your recovery codes, at the second step, where your organization allows it. Choose Use a recovery code. |
| Your recovery codes | Your authenticator app or a passkey, if you have one. Sign in and create a new set. |
| Access to your email | A session you are already signed in on. Add a second email there. |
If you are still signed in anywhere, you are not locked out. Use that session to add a method or a second email address before you lose it. Sessions and devices shows where you are signed in.
When to start account recovery#
If none of your methods work, start recovery.
- On the sign-in page, go to the password step and select Forgot password? You can also open Recover your account directly.
- Enter the email address of the account and select Send recovery message. The page says If that account exists, a message is on its way. Follow the link in it. It says the same whether or not the address has an account.
- Open the message titled Recover your TDACorp Identity account in the same browser you asked from, and select Start recovery.
- The page titled Continue recovery says that opening it changes nothing. Select Continue recovery to start.
- On Secure your account, make sure the account has a password (set one if it has none: the page says Set a password before finishing.), set up an authenticator app with its QR code, add a passkey with Add a passkey, and select Finish recovery. The page says Recovery is finished. Sign in with your new details.
The recovery email says it signs you out everywhere and limits the new session to your security settings until you set your sign-in methods again. That is the English wording: the email follows the language saved on the account, see Languages.
Recovery can include a wait#
For an account that has a passkey or an authenticator app, recovery is held for at least 24 hours (the platform can lengthen it to at most 3 days), and the recovery page says 24 hours. The page may say Recovery is on hold until a time it names, and that it waits before anything changes. The wait protects you: while it runs, the platform emails every verified address on the account with a Cancel recovery button, so a recovery you did not start can be stopped. You can ask again from the same browser once the time has passed.
The recovery page also has an optional I have a recovery code field. The page itself tells you what to expect once you reach it.
Your password always works#
A correct password is always enough to sign in. If you lost your passkey, type your password. On a browser the account already uses you are signed in. On a new browser or place the page asks for your passkey, and also offers Email me a code instead and Continue with my password only (limited session). The limited session is signed in at the lower level, sends you an alert email and asks you to confirm it is you before sensitive actions. Only a sign-in the platform judges too risky is refused. A limited session cannot add a passkey: if your account has an authenticator app, confirm with it and then add the new passkey from Security; if it does not, use I lost my passkey to start account recovery, where you can add the new passkey.
If you lost your only passkey#
After a correct password, if a passkey is the only second step your account has, the Confirm it is you page can offer Email me a code instead. It says Lost your passkey? We can email an 8-digit code to the address you are signing in with instead. The code goes to the address you are signing in with, and your other verified addresses are told that it was sent. The page notes This sign-in is one level lower than a passkey, and some apps will still ask for your passkey. If you have no other verified address the page adds You have no other verified address, so nobody else can be told.
A sign-in this way is limited. It sends you an alert email, it is not remembered on the device, and from it you cannot sign other sessions out, leave organizations, accept or decline invitations, add an email address, cancel a recovery, revoke an application's access or mark security events read until you confirm with a passkey or authenticator code. The number of codes you can request is limited. It is offered only where the platform has turned it on (flag login_email_fallback).
The same page has an I lost my passkey link to Recover your account, with your address filled in. Use it to add a new passkey or authenticator app on Secure your account; recovery for an account with a passkey is the slower route above.
If you did not ask for recovery#
Select Cancel recovery in the message. On the Continue recovery page the link is Cancel the recovery, under Did you not ask for this?. Then change your password. Then read If you think your account was taken over.
Prevent the next lock-out#
- Add a second passkey on another device. See Add a passkey.
- Create and store recovery codes. See Keeping recovery codes safe.
- Add a second verified email address. The security checkup counts it as a step.
- Read Protecting a lost device.
When recovery does not help#
Recovery proves you can read mail sent to an address on the account. It cannot help if you have lost the mailbox and have no other way in. If an administrator suspended or deactivated your account, you cannot sign in until it is reactivated. The platform emails you when an administrator does this, and an administrator of your organization is the person to ask.
An account that an organization manages for you has no sign-in methods of its own to recover. Recovery sends no message for it, and the account cannot set its own passkeys, password or authenticator: the app answers Your organization manages this account, so this is not available here. Ask your organization’s administrator. Ask that organization's administrator. An organization can manage accounts this way only where the platform has turned on tenant connections or SCIM provisioning (flags tenant_connections and scim, both default OFF).
If a sign-in needs a second factor you do not have#
Some sign-ins need a passkey or an authenticator app: the admin console, an application that asks for a stronger sign-in, or an organization that requires one. After a correct password, an account with neither shows Sign-in was refused. The page says Your account has no passkey or authenticator app, and the admin console, the application by name, or your organization needs one. It adds Fastest way: recover your account. Nothing is set up yet, so there is no wait. Add a passkey or an authenticator app, finish, then sign in again.
An account with no passkey and no authenticator app has no hold on recovery, because there is nothing to protect. Your current password still works and stays in place unless you change it on Secure your account.
- Select Recover your account on the refused page and enter the address of the account.
- Open the message in the same browser, select Start recovery, then Continue recovery.
- On Secure your account, add an authenticator app, a passkey with Add a passkey, or both.
- Select Finish recovery, then start the sign-in again.
This is not the route to add a factor from Security in your account: that change is held back for a browser your account has known for 24 hours, so it rarely works at this point.