Skip to content

Help a user who lost every authenticator

A member who has lost every passkey and authenticator app, and their recovery codes, cannot sign in. You cannot reset their authenticators yourself, because they belong to the person's account, which serves every organization the person belongs to. Instead, ask the platform's recovery authority to recover the account.

Who can do it

A tenant administrator or a tenant access administrator of your tenant. The console shows the lifebuoy icon only to a person who holds the permission to request a user's recovery.

The request is your tenant's own consent, so only your own administrators can file it: a platform operator working inside your tenant under a support-access session is refused.

Before you start

  • The person must have accepted their invitation. An invitation not yet accepted has nothing to recover; re-send the link instead.
  • A person who signs in through your tenant's identity provider is recovered by that provider, not here.
  • On an ANKA-hosted deployment, your request is what allows the platform to recover the person: without it, the platform does not reset the credentials of your users.

Steps

  1. Open Users in the sidebar.
  2. On the person's row, select the lifebuoy icon (Request account recovery). It is not shown for yourself, for an invitation not yet accepted, or while your tenant's request for that person is still pending.
  3. Read what the recovery does, then select Request recovery.

What you see when it worked

The console says the recovery was requested for the person's address, and their row shows Recovery requested.

Filing the request changes nothing by itself. When the platform's recovery authority performs it, every passkey, authenticator app, recovery code and password of the person stops working, every session they have ends, and the person receives a one-time enrolment code to set up a new authenticator. The row then shows Recovered, awaiting enrolment until they do. No administrator learns or chooses the new credential.

Filing again while your request is still pending changes nothing and answers the pending request.

If it fails

The console shows The request was not filed, with the reason:

Reason Cause What to do
The membership is an invitation not yet accepted The person never activated their membership Re-send their link instead
The person is not a member of your tenant The membership was removed, or the address belongs to another tenant Check the person in Team Members
A refusal that the operation is not available while acting on behalf of a tenant You are in a support-access session An administrator of your tenant files the request
A refusal that the person is recovered by the identity provider (federated-credential-recovery) The person signs in only through your tenant's identity provider Recover the person at that provider

Without the console

Surface How
API POST /api/v3/admin/tenants/{tenantId}/users/{userId}/recovery-requests (operation createUserRecoveryRequest)

The key management CLI and the admin SDK have no command or method for this task.