> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/access-control/account-unlock.md). # Account Unlock Harmony's AI agent can now handle account unlock requests from start to finish, without requiring manual IT intervention. When an employee reports being locked out, the agent checks their account status in real time, identifies the cause of the lockout, and triggers the appropriate unlock workflow automatically - all within a single conversation. Account unlock support is available for both **Okta** and **Microsoft Entra ID**, covering the most common identity providers used across modern organizations. *** ### How It Works When a user submits an account unlock request through the AI agent, the following steps happen automatically: 1. The agent receives the employee's request and identifies the affected user account. 2. It queries the configured identity provider in real time to check the current account status. 3. It determines the cause of the lockout (for example, too many failed sign-in attempts or Smart Lockout enforcement). 4. It initiates the appropriate unlock workflow based on the identity provider. 5. The employee is notified once the unlock is complete or if further action is needed. No ticket routing, no manual escalation, and no waiting on an IT technician to run a query. *** ### Supported Identity Providers #### Okta Account Unlocks When an employee is locked out of their Okta account, the agent: * Detects that the account is in a locked state by checking Okta in real time. * Creates an unlock ticket to trigger the account unlock workflow directly within Okta. * Confirms the outcome back to the employee once the workflow completes. This removes the need for an IT administrator to manually locate the account in the Okta console and initiate the unlock. #### Microsoft Entra ID - Smart Lockout Detection When an employee is locked out of their Microsoft Entra ID account, the agent: * Identifies that the account has been locked via Entra's Smart Lockout mechanism. * Detects the lockout cause based on real-time account status signals. * Initiates the unlock workflow automatically to restore access. Smart Lockout in Entra ID triggers after a threshold of failed sign-in attempts, and the agent handles detection and remediation without requiring an administrator to intervene through the Azure portal. *** ### Prerequisites Before account unlock automation is available to your employees, make sure the following are in place: * Your Okta or Microsoft Entra ID integration is connected and authorized within Harmony. * The AI agent has been granted the necessary permissions to read account status and trigger unlock actions in the relevant identity provider. * Account unlock workflows are enabled in your agent configuration. Refer to the integration setup guides for [Okta](/ai-agents/access-control/account-unlock.md) and [Microsoft Entra ID](/ai-agents/access-control/account-unlock.md) for permission and scope requirements. *** ### Employee Experience From the employee's perspective, the interaction is straightforward: 1. The employee messages the AI agent describing their lockout (for example, "I can't sign in, my account is locked"). 2. The agent confirms their identity and looks up their account. 3. Within the same conversation, the agent resolves the lockout and lets the employee know they can try signing in again. There is no need to submit a support ticket, wait for an IT queue, or follow a multi-step self-service portal flow. *** ### Notes and Considerations * The agent handles unlocks only for accounts that are locked due to authentication failures or policy-triggered lockouts. Accounts that are disabled or suspended for administrative or compliance reasons are not unlocked automatically. * If the agent cannot resolve the lockout - for example, due to a permissions issue or an unsupported lockout state - it escalates the request to a human agent and informs the employee accordingly. * All unlock actions are logged for audit purposes within Harmony's activity history. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.harmony.io/ai-agents/access-control/account-unlock.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.