Accounts are configured by IT in the server's appsettings (password hashes only). After 5 failed attempts the account is locked for 15 minutes.
appsettings
Adding scanning to a web app? Read the developer guide (no sign-in needed).