User Lock Out Risk Detected

Detects Duo users who are locked out but have successfully accessed other resources/systems, or users with multiple Duo accounts where only some are locked out. Duo's lock out feature can be a very powerful remediation tool when investigating potentially malicious user activity. However, locking users out of Duo can also unintentionally revert users to the access and authentication requirements of other systems, like your identity provider (IdP), allowing them to circumvent the intended security and MFA policies configured in Duo.

Additionally, locked out users attempting to regain access are more susceptible to phishing or social engineering attacks (which may have triggered the initial lock out) and may resort to less secure MFA alternatives or credential sharing, making it easier to successfully compromise a targeted account.

Recommended Actions

Review the policy that enabled the account(s) to successfully access resources despite being locked out in Duo, and understand how the relevant policies work across Duo and the affected system(s). Make any necessary policy configuration changes to ensure that the resource is properly protected by Duo policies and that there are no unintended loopholes, or enforce strong forms of MFA for that resource in the affected system. For users with lock out status discrepancies across multiple Duo accounts, investigate each of the user's Duo account to determine if there was any concerning behavior, then assign the appropriate status to all of the user's accounts.

Compatibility

Duo