Login lockout and rate limits: what happens after wrong passwords

Two counters, not one

Failures are counted per account and per network address. An attacker who targets your account from one place trips both and is stopped; an attacker who sprays one password across many accounts trips the address counter first. A tenant who mistypes their password three times on the portal does not affect your staff sign-ins.

Why a delay before a lockout

A hard lockout after three tries is a weapon: anyone can lock you out of your own account by typing nonsense. Slowing each answer down first makes guessing useless long before the lockout, and the lockout itself is short enough to be an inconvenience rather than a denial of service.

Telling a lockout from a forgotten password

A lockout says so on the page and gives the time it clears. A forgotten password just says the sign-in failed. If you see the lockout message and you did not make the attempts, somebody else did: wait for it to clear, sign in, change your password, and confirm two-factor is on. The attempts, with their addresses and times, are in the audit log.