Reset a person's authenticators (helpdesk)

When a person has lost every factor and has no recovery codes, an administrator resets their authenticators and gives them a single-use enrollment code. The person uses it like a recovery code to create a new passkey.

Before you start

• Check the caller's identity through a channel that does not depend on the lost account (in person, or a call to a number you already know). The service does not do this check for you.
• An administrator can reset another administrator's authenticators, but not their own.
• The person must be active.

How do I reset?

1. Under «Manage» › «Users», choose «Reset ↗» on the person's row. «Reset authenticators» opens.
2. Fill in:
   • «Reason»: «Lost device», «Suspected compromise» or «Other».
   • «Request reference (optional)»: the ticket number in your support system.
   • «Authenticators to revoke»: passkeys, «TOTP/HOTP/OCRA codes», Presence.
   • «Approver phones to remove»: the lost phones (up to three).
   • «Code validity»: «1 hour», «24 hours» or «72 hours».
3. Confirm. The chosen authenticators and phones are revoked, and every session and recovery code of the person ends.
4. The console shows the «Enrollment code» once, and a «Message for the user» ready to send.
5. «Deliver the code through a verified channel. Closing this screen deletes it from the browser; it is not shown again.»

If the person's email is confirmed, they also get an email notice, without the code.

What about the password?

It does not change. With the reason «Suspected compromise», the password is marked compromised and no longer signs in.

What does the person do?

On the sign-in page they choose «Use recovery», type the code and create a replacement passkey. See Sign in with a recovery code.

I lost the code before handing it over

Do a new reset. The new one cancels the previous code.

Requiring a second administrator

See Dual approval of resets.