AADSTS50053 — the account is locked because of too many failed sign-in attempts, or sign-in was blocked because it originated from an address associated with malicious activity. Entra smart lockout locks the account for a short period after repeated wrong passwords (by default, 10 failed attempts trigger a 60-second lockout, escalating on continued failures). It protects the cloud credential — the on-prem AD account may or may not be locked separately.
AADSTS50053
Account locked (smart lockout)
What it means
Common causes
A stale saved password keeps retrying: old phone mail profile, background service, mapped drive, scheduled task or forgotten device.
Password-spray or brute-force attempts against the account from the internet.
The user genuinely mistyping repeatedly after a recent password change.
How to fix it
Check Entra sign-in logs (Entra admin center > Users > (user) > Sign-in logs) for the failing source: client app, IP and device usually identify the stale credential or the attack source.
Hunt down the device/app replaying the old password and update or remove the saved credential.
If under spray attack: confirm smart lockout settings (Entra admin center > Protection > Authentication methods > Password protection), enforce MFA, and consider blocking legacy authentication via Conditional Access.
The lockout clears itself after the lockout window; a password reset by an admin also unlocks cloud sign-in.