Address review comments on #5956.

[ImalshaD]

Fixes review comments on

• [Feature] Application level retry/resend control limits. #5956

This pull request updates the documentation to clarify the behavior of account locking during authentication flows. The main change is to specify that account locks occur at the organization level, not the tenant level, which helps prevent confusion about where lockouts are enforced.

Documentation clarification:

• Updated the note in otp-retry-resend-limits.md to state that user accounts are locked at the organization level (rather than the tenant level) if there are too many failed login attempts, ending the authentication flow immediately.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates terminology in OTP retry/resend limits documentation, changing "tenant level" to "organization level" for consistency with product terminology.

Changes:

• Replaced "tenant level" with "organization level" in the account lock precedence note.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Run ID: 91c94b88-ed2a-44fe-bade-dabc52547aee

📥 Commits

Reviewing files that changed from the base of the PR and between 67fdcdc and 62a6361.

📒 Files selected for processing (1)

• en/includes/guides/authentication/conditional-auth/otp-retry-resend-limits.md

---

📝 Walkthrough

Walkthrough

This PR updates documentation for OTP retry and resend limits to clarify that account locking at the organization level takes precedence and immediately ends the authentication flow before the maximum allowed failure attempts threshold is reached.

Changes

OTP Retry Limits Documentation

Layer / File(s)	Summary
Account lock precedence clarification en/includes/guides/authentication/conditional-auth/otp-retry-resend-limits.md	Reworded the "Account lock takes precedence" note to specify that organization-level account locks (triggered by failed attempts) terminate the authentication flow immediately, before maximumAllowedFailureAttempts is reached, replacing prior tenant-level phrasing.

Suggested labels

Team/Authentication & registration

Suggested reviewers

• AfraHussaindeen

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Address review comments on #5956' is vague and non-descriptive, referring only to a PR number without indicating what specific change was made.	Replace with a specific title describing the main change, such as 'Clarify organization-level account locking in OTP documentation' or 'Update account lock documentation to specify organization-level enforcement'.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description covers the purpose and what was changed, but is missing required sections: Test environment and Security checks from the template.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}