Reset a user's two-factor authentication
When a user has lost both their authenticator app and their backup codes, an administrator resets their two-factor authentication from Settings > Users so they can sign in again with their password.
Reset a user's two-factor authentication
When someone has lost both the phone with their authenticator app and their backup codes, they cannot get past the code step at sign-in. An administrator resets their two-factor authentication, which lets them sign in with their password alone and set it up again.
Before you start
- You need the Edit permission on Users; in the default roles only the Administrator has it.
- Make sure the request really comes from the user. After a reset, the password alone opens the account.
- You cannot reset your own two-factor authentication. If you are the one locked out, ask another administrator. If there is no other administrator who can do it, contact NirmaanOne support; the support team resets it once they have confirmed who you are.
- If the user still has an unused backup code, they don't need a reset: they can sign in with Use a backup code instead and then use Regenerate backup codes on My Profile (see Two-factor sign-in).
Steps
- Confirm that the request really comes from the user, for example by calling them on a number you already know. A reset lets anyone with the password sign in, so never skip this.
- Open the account menu in the top bar, choose Settings, then the Users tab (Users).
- Type part of the person's email in Search by email. Their row shows "On" in the 2FA column.
- Click the lock icon on their row (tooltip "Reset two-factor"). The dialog "Reset two-factor authentication?" says: "Use this when <email> has lost both their authenticator and their backup codes, and you have confirmed it is really them. They are signed out everywhere and can sign in with their password alone; if your organization requires two-factor, they must set it up again before using anything else."
- Click Reset two-factor. You see "Two-factor authentication reset for <email>." and the 2FA column reads "Off".
What happens next
- The user is signed out everywhere, on every browser and device, and every AI assistant connected as them stops until they connect it again.
- They sign in with their password alone. Their old authenticator entry and backup codes no longer work.
- If your organization requires two-factor, they can only open My Profile until they set it up again (see Set up two-factor authentication and require it for everyone). Otherwise setting it up again is up to them, though it is worth asking them to.
- The reset is recorded against the user in the audit trail.
If something goes wrong
- There is no lock icon on the row. It shows only for users who have two-factor turned on, never on your own row, and only to people with the Edit permission on Users.
- "You cannot reset your own two-factor authentication; ask another administrator": another administrator has to do it.
- "Two-factor authentication is not enabled.": the user's two-factor was already off (someone reset it, or the user turned it off). Refresh the list; they can sign in with their password.
Related
Related
- UsersScreen
The people in your organization: invite new users, change their role, deactivate or reactivate them, reset a lost two-factor authentication, and resend or revoke pending invitations.
- Two-factor sign-inScreen
Turn on two-factor authentication with an authenticator app, sign in with a 6-digit code or a backup code, manage your backup codes, and what happens when your organization requires it.
- My ProfileScreen
Your own account: see your email, organization and roles, change your name and phone, change your password, turn two-factor authentication on or off, and sign out everywhere.
- Sign inScreen
Sign in to NirmaanOne with your email and password, and with a 6-digit code or a backup code when your account has two-factor authentication.
- Set up two-factor authentication and require it for everyoneHow-to
Turn on two-factor authentication for your own account with an authenticator app on My Profile, save your backup codes, sign in with a code, and then, as an administrator, require it for every user of the organization.
- Change a user's roles, or deactivate a userHow-to
Give a user a different role from Settings > Users, or deactivate someone who has left so they are signed out everywhere and can't sign in, and reactivate them if they come back.
- User accounts: invitations, status and sign-inConcept
How a person gets an account (by invitation), the four user statuses and how they are derived, how long an invitation link lives, what happens at sign-in with and without two-factor authentication, how long a session lasts, and what deactivation does.
- Cannot sign in: wrong password, pending invitation, deactivated account or a rejected codeTroubleshooting
The sign-in form, the two-factor step or a password form refuses you: what each message means, the rule behind it and how to get back in.
- Pages refuse to load data: your organization requires two-factor authenticationTroubleshooting
A red banner says most pages will refuse to load data, dashboard sections fail and every list shows the same message: the organization now requires two-factor authentication and your account has not set it up yet.