What happens if a user enters the wrong CardDAV password multiple times?

If employees enter their CardDAV password incorrectly—whether in the configuration of the iPhone Contacts app, in the sync.blue® app for Android, or in an MDM profile—the question quickly arises as to whether this affects other users or even entire company accounts.
The good news: No.

This article explains how repeated failed logins behave—and what does not happen.

1. The sync.blue® MOBILE Storage behaves per connection—not globally

If a password is entered incorrectly, the sync.blue® MOBILE Storage (CardDAV server) generally responds with a simple 401 error message (“Unauthorized”)—exclusively for that single request.

If the server is configured accordingly, a small security delay may occur (e.g., about 30 seconds) to make trivial brute-force attacks more difficult.
However, this delay only affects the individual connection of the specific device.

2. No IP bans—even if many users share the same company IP

Modern corporate networking often works via central gateways or NAT firewalls. This means:
from the outside, many employees appear as a single IP address.

never be blocked.

Even if a user enters a wrong password ten times in a row,
any possible delays affect only that single request.

Other employees using the same external IP remain completely unaffected.

3. No global blocking of a username

Even if a user of a company enters the login credentials incorrectly multiple times: the user account will not be blocked server-side.

That means other users with the same domain suffix/company tenant remain fully usable.

Thus, sync.blue® MOBILE Storage does not perform account blocks that could affect other users.

4. No impact on other employees or devices

Even with numerous incorrect entries:

• Devices of other employees continue to sync as normal
• MDM profiles of other users remain active
• There are no interruptions in the company contact provisioning
• No entire company access is “slowed down” or blocked

Conclusion

Multiple incorrect password entries cause effects exclusively on the individual connection and on the individual device.

Neither IP addresses nor other users or company accounts are ever blocked as a result.