Salesforce's help articles route almost every lockout through someone who already has admin access in your org. The one path that skips them, a change to a sole admin's email, takes a signed letter from an executive of your company. Knowing which case you are in decides who you call first.
A different login error? Match it to its fix in Can't log in to Salesforce?
Which kind of Salesforce lockout is it?
| What happened | What it means | Who can fix it | Fix |
|---|---|---|---|
Too many wrong passwords (API error PASSWORD_LOCKOUT) | The profile's maximum invalid login attempts was reached | The clock, or an admin with Manage Internal Users | Wait out the lockout period, or Setup, Users, the user, Unlock |
| Locked out again every morning | An app or plug-in, such as Data Loader or an Outlook connector, keeps trying an old saved password | An admin | Check the user's Login History for repeated failed API logins; update the password saved in the app or remove it |
| MFA phone or key lost, broken or replaced | The registered method no longer works | An admin with Manage Multi-Factor Authentication in User Interface | Temporary verification code, then disconnect the old method (steps) |
| An admin stuck at Create a Passkey | Phishing-resistant MFA is enforced for privileged users | Another admin; Salesforce Support if there is none | Temporary code, then register a passkey (steps) |
| “Restricted IP” | Your IP address is outside the login IP ranges on your profile | Another admin; a Support case if you are the only one | Add your IP to the profile's ranges, or remove the ranges from the System Administrator profile |
| The account is frozen | The user record was frozen, which blocks login without deactivating it | An admin with Freeze Users or Manage Users | Setup, Users, the user, Unfreeze |
| You were the only admin and cannot reset your password or reach its email | Nobody in the org can edit your user record | Salesforce Support | The C-level letter process (below) |
Sources, in row order: (Best Practices for Handling and Troubleshooting Failed Logins, Salesforce, published 1 Jul 2026), (User is Locked out of Salesforce Daily, Salesforce, published 23 Sep 2026), (Resolve MFA Access Issues for Your Users, Salesforce, read 16 Oct 2026), (Resolve Passkey Login Issues in Salesforce, Salesforce, published 12 Oct 2026), (Unable to Log In to Salesforce Due to "Restricted IP" Error, Salesforce, published 11 Oct 2026), (Freeze or Unfreeze User Accounts, Salesforce, read 16 Oct 2026) and (Unable to change your Salesforce system administrator, Salesforce, published 2 Jul 2026).
Who can restore your access, in order
The clock
A password lockout ends by itself after the lockout period, 15 minutes unless your admin changed it.
You
Forgot Password, if the lockout is only the password and your email still works.
Another admin in your org
Unlock, Unfreeze, a temporary verification code, disconnecting a lost MFA method, adding your IP to the profile, correcting your email.
Your company's email administrator
Catch the password reset email for a departed admin when your company owns the email domain.
Salesforce Support
Only when no admin in the org can act: disconnecting a sole admin's passkey, a case for a sole admin's IP restriction, or changing a sole admin's email after a C-level letter.
- Wait if it is a password lockout. The Lockout effective period defaults to 15 minutes. A user already logged in elsewhere stays logged in to that session (Password Policy Fields in Profiles, Salesforce, read 16 Oct 2026).
- Reset the password yourself with Forgot Password on the login page, if the email on your user record still reaches you.
- Ask another admin. In Setup they open Users, click your name and use Unlock (it appears only while you are locked out), Unfreeze, or Generate next to Temporary Verification Code. The Failed Login Attempts field on the same record shows the count (Unlock Users, Salesforce, read 16 Oct 2026).
- If the former admin left, try the email domain. When your company owns the domain of that admin's email, your email administrator can receive the password reset for that mailbox (Unable to change your Salesforce system administrator, Salesforce, published 2 Jul 2026).
- Only then, Salesforce Support. Open the case with your org ID and the locked admin's username ready.
What Salesforce Support can and cannot do
| Situation | Salesforce Support | Source |
|---|---|---|
| The only admin lost the device holding their passkey | Can disconnect the existing passkey; bring the org ID and admin username | (Article 005390721, Salesforce, published 12 Oct 2026) |
| The only admin is blocked by MFA | Helps when no other admin can issue a code | (Resolve MFA Access Issues, Salesforce, read 16 Oct 2026) |
| The only admin hits “Restricted IP” | Takes a Support case | (Article 005389372, Salesforce, published 11 Oct 2026) |
| A user who is not an admin hits “Restricted IP” | Cannot help without a System Administrator involved | (Article 005389372, Salesforce, published 11 Oct 2026) |
| No admin can reach the admin user record | Changes that admin's email after a signed C-level letter | (Article 000385418, Salesforce, published 2 Jul 2026) |
| The new admin email is on Gmail, Yahoo or another free domain | Will not make the change; the domain must be one your company owns | (Article 005299571, Salesforce, published 29 Jan 2026) |
| Someone without a Salesforce license wants to open the case | Cannot; only users with Salesforce license types create cases | (Article 005167035, Salesforce, published 4 Sep 2026) |
How you reach Support depends on your success plan. Salesforce Help lists Help Agent chat around the clock for Standard, Premier and Signature customers, phone support for Premier and Signature, phone for Standard customers only on Severity 1 (business-stopping) issues, and no live chat for free or trial orgs (How to Get Support from Salesforce Help, Salesforce, published 4 Sep 2026).
For businesses on Salesforce
No second Salesforce admin? Set one up before the next lockout.
How to prove you own the org: the C-level letter
When no other admin exists and nobody can reach the admin user record, Salesforce Support changes that user's email so a password reset can reach you. It asks for a letter from a C-level executive (Salesforce names CEO, CIO, CFO or business owner), on company letterhead if your company uses one, containing (Unable to change your Salesforce system administrator, Salesforce, published 2 Jul 2026):
- The current full username of the user record to change.
- The new email address, on your company's own domain.
- Why the change is needed.
- The Support case number.
- The executive's signature, title and email address.
- If you are a Salesforce implementation partner, a line saying so.
Scan the signed letter and email it to the Support representative on your case; with no case open yet, create one with the Feature Activations & Limits team. Support escalates the letter for review; if it is approved, Support changes the address, emails both the requester and the executive from the case, and you set a new password with Forgot Password. Salesforce's closing advice in that article is to keep more than one System Administrator at all times.
Sandboxes differ. A sandbox refresh appends .invalid to user emails, so a sole sandbox admin who forgets the password never receives the reset. A case with Support's Activations team fixes that without a C-level letter, but only by matching the sandbox email to the same user's production email (Change Salesforce Sandbox Administrator Email Address When Locked Out, Salesforce, published 15 Jul 2026).
How to prevent the next Salesforce lockout
- Keep at least two admins. Both with the Manage Multi-Factor Authentication in User Interface permission, so either can issue a temporary code for the other (Resolve Passkey Login Issues in Salesforce, Salesforce, published 12 Oct 2026).
- Register two phishing-resistant methods per admin, for example a passkey and a security key, as the Salesforce Admins blog recommends (Salesforce Admins blog, Salesforce, 22 Jun 2026, updated 6 Jul 2026).
- Write a break-glass protocol. The same Salesforce post describes one agreed with your IT or security team: a video call or in-person identity check with a named security contact, who then authorizes another admin to log in and generate the locked admin's temporary code.
- Keep one admin able to log in without SSO. Salesforce recommends that some admins can log in directly with username, password and MFA, so an outage at your identity provider does not lock everyone out (FAQs for Single Sign-On, Salesforce, read 16 Oct 2026).
- Put admin emails on your company's domain. Support will not move a sole admin to a free email address, and a company domain lets your email administrator recover a departed admin's reset email.
- Write down the org ID now, from Setup, Company Information, while you can still log in. Every Support case starts with it.
If your company has no second Salesforce admin
We are an independent Salesforce consultancy, separate from Salesforce Support. We cannot unlock a user, reset MFA or change an admin's email from outside your org; only an admin inside it, or Salesforce, can. What we do is the work that keeps a business from depending on one login: a second admin, a break-glass account, passkeys enrolled for everyone who needs them, and SSO and integrations that keep working through the next change. That is the admin work inside our Salesforce managed services.
Frequently asked questions
How do I contact Salesforce Support if I'm locked out?
Salesforce Help suggests asking your Salesforce admin or a colleague with access to log a case for you, since only users with Salesforce licenses can create cases. Help Agent chat is listed as available around the clock for Standard, Premier and Signature customers, phone support for Premier and Signature, and for Standard customers on Severity 1 issues. Live chat is not offered to free or trial orgs.
How long does a Salesforce lockout last?
As long as the Lockout effective period in your password policy. The default is 15 minutes. A user with permission to unlock users can end it sooner from the user's record in Setup.
Can Salesforce Support reset my password?
Salesforce's documented path for an org with no other admin is different: Support changes the locked admin's email address after a signed letter from a C-level executive, and the admin then resets the password with Forgot Password.
What does "contact your Salesforce administrator" mean?
Your company's Salesforce admin manages your user record: unlocking it, issuing temporary codes, disconnecting lost MFA methods and setting IP ranges. Salesforce's help pages send users to that admin first, and for an IP restriction Salesforce Support cannot help without an administrator involved.
Can the admin email be changed to a Gmail address?
Not through Support. Salesforce Support will not change a System Administrator's email to a free, public email domain; the new address must be on a domain your organization owns.