We currently have the Maximum number of consecutive failed sign-in attempts set to five. We recently learned that when this threshold is reached, Docebo blocks the originating public IP address for 10 minutes, not just the individual user account.
We expect some clients to have between 500 and 1,000 learners, or even more potentially accessing the platform through the same corporate network. During a coordinated launch, several learners could enter incorrect passwords within a short period and unintentionally trigger a lockout affecting everyone on that network.
For organizations supporting large learner populations, what maximum number of failed attempts have you configured? Have you experienced shared public-IP lockouts, and would you recommend a threshold such as 50 or 100?
It would also be helpful to confirm whether a successful login resets the failed-attempt counter for the public IP and whether failed attempts across different usernames are aggregated.