A system comprising: at least one processor of an application server computing device; a memory of the application server computing device; and at least one module loaded into the memory causing the at least one processor to: receive, from a client being a client device or a client application executing on the client device, user credentials for a user of the client, the client being a legacy client that does not support rich fault messaging or the client using a legacy protocol which does not support rich fault messaging; forward the received user credentials to an identity provider; receive authentication evaluation state information from the identity provider in response to unsuccessful authentication of the user of the client device at the identity provider, wherein the received authentication evaluation state information indicates that the user credentials (110,114) are valid but that a user account of the user is in a locked state in which synchronization, that updates user data files on the client device, is prevented; and send a notification sync message to the client application executing on the client device through a synchronization mechanism already existing between the application server computer device and the client device, without updating data files on the client device, the notification message comprising information identifying a cause of the unsuccessful authentication of the user. at least one processor of an application server computing device; a memory of the application server computing device; and at least one module loaded into the memory causing the at least one processor to: receive, from a client being a client device or a client application executing on the client device, user credentials for a user of the client, the client being a legacy client that does not support rich fault messaging or the client using a legacy protocol which does not support rich fault messaging; forward the received user credentials to an identity provider; receive authentication evaluation state information from the identity provider in response to unsuccessful authentication of the user of the client device at the identity provider, wherein the received authentication evaluation state information indicates that the user credentials (110,114) are valid but that a user account of the user is in a locked state in which synchronization, that updates user data files on the client device, is prevented; and send a notification sync message to the client application executing on the client device through a synchronization mechanism already existing between the application server computer device and the client device, without updating data files on the client device, the notification message comprising information identifying a cause of the unsuccessful authentication of the user. receive, from a client being a client device or a client application executing on the client device, user credentials for a user of the client, the client being a legacy client that does not support rich fault messaging or the client using a legacy protocol which does not support rich fault messaging; forward the received user credentials to an identity provider; receive authentication evaluation state information from the identity provider in response to unsuccessful authentication of the user of the client device at the identity provider, wherein the received authentication evaluation state information indicates that the user credentials (110,114) are valid but that a user account of the user is in a locked state in which synchronization, that updates user data files on the client device, is prevented; and send a notification sync message to the client application executing on the client device through a synchronization mechanism already existing between the application server computer device and the client device, without updating data files on the client device, the notification message comprising information identifying a cause of the unsuccessful authentication of the user.