Skip to content

Reset a forgotten password

Set a new password when you cannot remember yours, through a link sent to your e-mail address.

Who can do it

Anyone, from the sign-in screen: no session is needed, because the link proves who you are.

  • You are one person with one password for every tenant you belong to, so you receive one link, and the new password applies in every tenant.
  • A person who signs in only through an identity provider and holds no password sets a first password through the same link.
  • A person who is completing an account recovery that an administrator started receives no link: that recovery is completed only with the enrolment link it sent. The sign-in screen answers the same way, so nothing tells whether a link was sent.
  • A platform administrator receives no link: a platform account is recovered through the platform's assisted recovery. The sign-in screen answers the same way.

Before you start

  • Have access to the mailbox of the address you sign in with.
  • The link works once and expires after 60 minutes by default (the platform setting security.password-reset.token-expiration-minutes, 5 to 1440). Requesting a new link makes the earlier one stop working.
  • The new password follows the password policy: 15 to 128 characters, not a common or compromised password, not containing the product name or the part of your e-mail address before the @, and not one of your recent passwords.

Steps

  1. On the sign-in screen, select Forgot password?.
  2. In Reset your password, type your e-mail address and select Send Reset Link.
  3. Open the e-mail and follow its link. It opens the console's reset page.
  4. Fill in New password and Confirm password.
  5. Select Reset Password.

What you see when it worked

After step 2 the screen says "If an account exists with that email, you'll receive a reset link shortly." It says the same whether or not the address belongs to an account.

After step 5 the page shows Password reset successfully and returns to the sign-in screen after a few seconds. Every session you held, in every tenant, has ended: sign in with the new password. The reset is listed under Recent security activity on your Security page.

If it fails

What you see Cause What to do
Reset link expired: "This password reset link has expired. Please request a new password reset." The link's lifetime (60 minutes by default) passed since it was sent Select Request new reset link and start again
Reset link already used: "This reset link has already been used or is invalid. Please request a new password reset." The link was already redeemed, or a newer link was requested after it Request a new link
"The activation or reset link is invalid." The link is malformed, or no longer names an account that can be reset Request a new link, and use the newest e-mail
No reset token: "No password reset token was found." The page was opened without the link's token Open the link exactly as it arrived in the e-mail
A message naming the password rule, such as "The password must be at least 15 characters long." The new password breaks the password policy. The link stays usable Choose a password that meets the rule and submit again
"The new password was used previously. Please choose a different password." The password is one of your recent ones Choose another password
"Passwords do not match" The two fields differ Type the same password in both
No e-mail arrives The address is not the one you sign in with, the message was filtered, you are completing an account recovery an administrator started, or you are a platform administrator Check the address and your spam folder; in an account recovery, use the enrolment link it sent

Without the console

Surface How
API POST /api/v3/auth/account/password/forgot with email only (operation forgotPassword), then POST /api/v3/auth/account/password/reset with the link's token and newPassword (operation resetPassword)