Accounts are configured by IT in the server's appsettings (password hashes only). After 5 failed attempts the account is locked for 15 minutes.
appsettings
