How to Recover Access to a Locked Dashboard Account
Overview
This article explains how to recover access to a Cisco Meraki Dashboard account that has been locked. An account can become locked in two ways:
- A user enters an incorrect password too many times, triggering the account lockout threshold.
- A user attempts to log in from an IP address outside the configured Login IP ranges.
The lockout threshold is defined at Organization > Configure > Settings > Security > Account lockout. When a user exceeds this threshold, the Dashboard displays the following error on the login attempt:
The account shows the message "This account has been locked after too many failed login attempts."
To regain access after a standard lockout, another administrator with Full access at the network or organization level must unlock the account. The required access level depends on the locked account.
For accounts protected by Login IP ranges, the restriction is a security mechanism that Cisco Meraki cannot disable or modify without positively identifying the account owner. Configure login IP range restrictions with caution.
Prerequisites
- An administrator account with Full access at the network or organization level (matching the locked account's scope) to perform the unlock.
- For accounts protected by Login IP ranges: an administrator with Organization write privileges for the affected organization.
If two-factor authentication is enabled on the locked account, the Support Operations team cannot bypass this additional security. Disable two-factor authentication before the account can be unlocked.
Step-by-step instructions
Unlock an account with Organization permissions
-
Go to Organization > Configure > Administrators.
-
Select the checkbox next to the admin with the locked account.
-
Select Unlock.
Unlock an account with Network permissions
-
Go to Network-wide > Configure > Administration.
-
Select the Unlock button next to the admin with the locked account.
If no other administrators of equal or greater access exist, contact the Cisco Meraki Support Operations team. For security purposes, they may need to validate your identity before taking action.
Recover access to an account protected by login IP range restrictions
First, try to regain access by reaching out to your ISP and requesting that the IP address be restored to the previous one. If you can access the Dashboard, add or change the new IP at Organization > Configure > Settings > Security > Login IP ranges.
If you cannot regain access this way, recover access to a Dashboard organization from an IP outside the configured range as follows:
-
Open a case from the Support home page.
-
Use the email of an administrator with Organization write privileges for the organization whose login IP range needs to be disabled or modified.
-
Once in communication with a Cisco Meraki Support Operations Specialist, explain that the login IP range needs to be disabled or modified for the organization.
-
Provide the information the Support Operations Specialist requests about the organization and its contents and settings to verify the validity of the request.
-
Once these steps have been completed, a Cisco Meraki Licensing leader will email you a secure document that must be digitally signed and returned.
Verification
- After a standard unlock, the affected administrator can log in to the Dashboard without receiving the "This account has been locked after too many failed login attempts" error.
- After a login IP range recovery, the administrator can access the Dashboard organization from the intended IP address.
Troubleshooting
If two-factor authentication is enabled on the account, disable it before attempting the unlock; the Support Operations team cannot bypass it.
When an account is locked across multiple organizations, unlocking it in one organization unlocks it in all other locked organizations.