Why are our Salesforce accounts getting blocked for high-risk proxies?
Legitimate network connections are being incorrectly flagged as high-risk anonymizing proxies like TOR or Mullvad, causing administrator accounts to be repeatedly blocked. This leaves organizations locked out of their accounts for months without a clear way to prevent the behavior.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
Why are our Salesforce accounts getting blocked for high-risk proxies?
- 1Using PowerShell or the Microsoft Graph Explorer to manually update the user's onPremisesSyncBehavior property by setting isCloudManaged to true.Did this help you?
- 2Make a complaint to banking authoritiesDid this help you?
- 3Deleting all credentials in Credential ManagerDid this help you?
- 4Revoking sessions from Entra and having the user log back inDid this help you?
- 5Checking domain controller logs using lockout status.exe or looking for event IDs 4771 and 4776Did this help you?
- 6Turning off two-factor authentication temporarily when wanting QuickBooks to download activity.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“It has been two months, and all of our Salesforce accounts have started getting blocked.”source ↗
“We are not using any public VPNs or public proxies, but the accounts continue to be blocked due to high-risk anonymizing proxies (e.g., TOR, Mullvad VPN, etc.).”source ↗
“Is there any solution to prevent this behavior and avoid having our accounts blocked?”source ↗
“The owner of the company at one of our MSP customers just had something unexplainable happen. This may shock you but Microsoft is involved. She forgot her email pass to log into a brand new mobile device. I went to change her password and it threw the error "This user's password can't be reset because password writeback isn't turned on for your organization."”source ↗
“This exact thing happened to my coworker at our company 2 weeks ago”source ↗
“It's how our users often lock out their account after a fresh password reset.”source ↗
“Ran into a similar issue a decade ago with cached credentials not updating for O365 applets, might be something that's reared its head again.”source ↗
“Has anyone experienced this issue before? Random intervals all throughout the day. I cannot figure out how to fix it.”source ↗
“QuickBooks can’t get into my files but keeps trying all the time, and therefore my bank sends me emails telling me that somebody’s fraudulently trying to get into my bank account”source ↗
“I wish I could stop QuickBooks from going to the bank constantly, without disconnecting my QuickBooks and bank accounts.”source ↗
“My Swedish bank blocked my account the other week when I was overseas because of suspicious transactions. When I call them they say that I have transferred money to Revolut.”source ↗
Where this came up
People with this problem also raised
- 8Antivirus blocking legitimate software updates and installers
- 15Why do smoke detectors go off randomly in the middle of the night?
- 10Account deactivated for security reasons and stuck in ID verification loop
- 2Why are legitimate vendor emails going to quarantine?
- 2What to do after your bank account is hacked
- 4Why is my passport flagged as stolen?