What's the first thing you check when a user can't log in?
Whether the error happens on entering credentials, right after, or before the page even loads, because those point at completely different layers — a typo or reset issue, a session or 2FA problem, or a broader outage. Check whether it's one user or many, since a single account points at the account and a cluster points at your service. Only after narrowing that down do you look at account status, password state, or server logs.