Account Unlock
Harmony's AI agent can now handle account unlock requests from start to finish, without requiring manual IT intervention. When an employee reports being locked out, the agent checks their account status in real time, identifies the cause of the lockout, and triggers the appropriate unlock workflow automatically - all within a single conversation.
Account unlock support is available for both Okta and Microsoft Entra ID, covering the most common identity providers used across modern organizations.
How It Works
When a user submits an account unlock request through the AI agent, the following steps happen automatically:
The agent receives the employee's request and identifies the affected user account.
It queries the configured identity provider in real time to check the current account status.
It determines the cause of the lockout (for example, too many failed sign-in attempts or Smart Lockout enforcement).
It initiates the appropriate unlock workflow based on the identity provider.
The employee is notified once the unlock is complete or if further action is needed.
No ticket routing, no manual escalation, and no waiting on an IT technician to run a query.
Supported Identity Providers
Okta Account Unlocks
When an employee is locked out of their Okta account, the agent:
Detects that the account is in a locked state by checking Okta in real time.
Creates an unlock ticket to trigger the account unlock workflow directly within Okta.
Confirms the outcome back to the employee once the workflow completes.
This removes the need for an IT administrator to manually locate the account in the Okta console and initiate the unlock.
Microsoft Entra ID - Smart Lockout Detection
When an employee is locked out of their Microsoft Entra ID account, the agent:
Identifies that the account has been locked via Entra's Smart Lockout mechanism.
Detects the lockout cause based on real-time account status signals.
Initiates the unlock workflow automatically to restore access.
Smart Lockout in Entra ID triggers after a threshold of failed sign-in attempts, and the agent handles detection and remediation without requiring an administrator to intervene through the Azure portal.
Prerequisites
Before account unlock automation is available to your employees, make sure the following are in place:
Your Okta or Microsoft Entra ID integration is connected and authorized within Harmony.
The AI agent has been granted the necessary permissions to read account status and trigger unlock actions in the relevant identity provider.
Account unlock workflows are enabled in your agent configuration.
Refer to the integration setup guides for Okta and Microsoft Entra ID for permission and scope requirements.
Employee Experience
From the employee's perspective, the interaction is straightforward:
The employee messages the AI agent describing their lockout (for example, "I can't sign in, my account is locked").
The agent confirms their identity and looks up their account.
Within the same conversation, the agent resolves the lockout and lets the employee know they can try signing in again.
There is no need to submit a support ticket, wait for an IT queue, or follow a multi-step self-service portal flow.
Notes and Considerations
The agent handles unlocks only for accounts that are locked due to authentication failures or policy-triggered lockouts. Accounts that are disabled or suspended for administrative or compliance reasons are not unlocked automatically.
If the agent cannot resolve the lockout - for example, due to a permissions issue or an unsupported lockout state - it escalates the request to a human agent and informs the employee accordingly.
All unlock actions are logged for audit purposes within Harmony's activity history.
Last updated
Was this helpful?