3 ms·

In this scenario, it’s more secure to require the user to request their own password reset via their registered email address.

• horsawlarway 5y ago
  There are cases where this is impossible. Ex - You have gmail gated behind okta using MFA, and the lost device is the user's MFA (ex - phone using TOTP). If the user has no session currently logged in on another device, they won't be able to create a session without their MFA device, and therefore won't be able to access their email. How likely you are to hit this depends on org settings, like gmail session time, okta session time, mfa requirements, etc. Ideally - they'd have backup codes somewhere... but most users won't (or they'll do things like store them in their email...)
  • gkop 5y ago
    As an enterprise customer, in the scenario you provided, I’d prefer if the vendor makes this my problem, by forcing me to reset the individual user’s MFA configuration, rather than try to be helpful in such a way that requires support personnel have the ability to do so. (And if I lock myself out, make it very very expensive for me to prove my identity to recover access)