Select to view content in your preferred language

How to find the source of invalid logins for our ArcGIS Online Organization

194
1
08-19-2025 05:32 AM
AaronManuel2
Regular Contributor

Hello, we have a few built-in accounts on our AGOL org that we use to manage data so we dont have everything under people's named accounts. I'm dealing with an issue where I'm getting locked out of this account for 15 mins usually a few times a week at least, because too many invalid login attempts have occurred.

This happened when we changed the accounts password, so obviously whats happened is someone is running an automated process that is attempting to login and failing. Unfortunately we haven't been able to track this down. 

Has anyone used admin tools or the arcgis api for python, or network monitoring tools (fiddler?), to resolve something like this? Ideally I'd like to see the source machine, address or ip address so I can figure out where this is coming from.

Thank you.

0 Kudos
1 Reply
MobiusSnake
MVP Regular Contributor

You can use AGOL's history endpoint for this:

https://developers.arcgis.com/rest/users-groups-and-items/portal-history/

For the types parameter use a value of "u" (user) and look for records with an action of "failedLogin".  This will give you the source IP addresses.

0 Kudos