Does the recovery key appear in the ticket thread?

No. The recovery key is sent exclusively via direct message (Slack or Teams DM) and never included in ticket comments. With the message expiry option enabled, even the DM is overwritten after 1 hour.

What does it handle and what does it hand off to a human?

Harmony handles device identification, identity verification, key retrieval, and delivery end-to-end. It hands off to IT if: the employee can't be verified; the recovery key can't be retrieved from asset management; or an unexpected error occurs.

Can it help if the device isn't showing a recovery screen - just forgotten password?

Yes, as long as the device is company-owned and registered in asset management with a recovery key. For macOS, FileVault recovery keys can unlock the device even when the login password is forgotten; the same applies to BitLocker on Windows.

What does it need to be connected to before it works?

Asset management must have the employee's device assigned and a recovery key stored (synced from the MDM). The notifications system must be configured for OTP delivery and DM delivery of the recovery key. The workflow template must be explicitly enabled per tenant (disabled by default).

All agents

Device Recovery

Automated device recovery with identity verification and recovery key delivery.

Book a demo How it works

Works with

One run, end to endResolved

1Triggered when a user requests device recovery
2Verifies the requester's identity through a secure authentication step
3Retrieves the device recovery key from the connected device management system
4Delivers the recovery key to the user through their preferred communication channel
5Updates the ticket with the full outcome for audit and traceability

Overview

What Device Recovery does

Device Recovery is Harmony's automated workflow for restoring access to a locked company-issued laptop or desktop. When an employee is locked out of their physical device - whether due to disk encryption (BitLocker, FileVault) or a forgotten device password - they ask the helpdesk chatbot, Harmony verifies their identity, retrieves the device's recovery key from asset management, and delivers it via direct message. Optionally, it simultaneously resets the employee's IdP password and automatically expires the recovery key message after one hour for security.

Who it's for

Who Device Recovery Is For

Persona

Employees who can't log into their company-issued laptop or desktop.

Pain point

Device lockouts - especially encrypted disk lockouts - require an IT agent to look up the recovery key in the MDM or encryption management system, verify the employee's identity, and deliver the key securely. This is a slow, high-touch process for what is often a self-solvable problem. Harmony handles the identity verification, key retrieval, and secure delivery automatically.

How it works

How Device Recovery Works

Trigger

An employee tells the helpdesk chatbot they're locked out of their laptop or computer. The chatbot distinguishes device lockouts from work account issues (password/MFA), and routes device issues here.

1
Device identification
The chatbot calls list_user_devices to fetch the employee's assigned devices and presents them. If the employee has multiple devices, they choose which one. The chatbot always confirms the selected device before proceeding.
2
Ticket creation
A recovery request ticket is created with the device asset ID. The chatbot routes the request to the workflow.
3
Identity verification
The workflow verifies the employee via OTP or Okta Verify. If verification fails or times out, the ticket is escalated to IT.
4
Recovery key retrieval
On successful verification, the workflow fetches the device's recovery key from asset management, including OS type and device name.
5
Secure delivery
The recovery key is sent to the employee via direct message (never in ticket comments) using a template that includes device name and OS-specific instructions.
6
Optional password reset
If configured, the workflow also resets the employee's IdP password and delivers the temporary password via DM.

Outcome

If configured, the recovery key DM is automatically overwritten after 1 hour with a message indicating the key has expired, preventing the sensitive key from persisting in the chat history.

Capabilities

Device identification and selection

Lists the employee's assigned devices and requires them to confirm which device needs recovery before any action is taken.

Verify identity before delivering recovery key

Sends an OTP or uses Okta Verify to confirm the employee's identity before the recovery key is retrieved.

Retrieve device recovery key from asset management

Fetches the encryption recovery key (BitLocker/FileVault) for the selected device.

Deliver recovery key via DM only

Sends the recovery key exclusively via Slack or Teams DM, with OS-specific instructions - never included in ticket comments.

Optional IdP password reset

Configurable option to simultaneously reset the employee's IdP password after key delivery, so both the device and work account access are restored in a single flow.

Automatic recovery key message expiry

Configurable option to overwrite the recovery key DM after 1 hour with an expiry notice, removing the sensitive key from the chat history.

Strict scope enforcement

The agent prompt strictly separates device lockouts from work account issues (Okta, Entra, Google Workspace) and routes each to the appropriate workflow.

Escalate gracefully on any failure

If verification fails, the key can't be retrieved, or an error occurs, the ticket is reassigned to IT with a clear explanation.

Use cases

Main use cases

Employee Locked Out of Their Encrypted Laptop

An employee's Windows laptop is showing the BitLocker recovery screen and they don't know their recovery key. The chatbot confirms it's a device (not account) lockout, lists the employee's assigned devices, confirms the correct laptop, verifies identity via OTP, retrieves the BitLocker recovery key from asset management, and sends it via DM with Windows-specific unlock instructions.

Employee Who Forgot Their Mac Login Password

An employee can't log into their MacBook Pro because they've forgotten their device password. FileVault is enabled. The same flow applies - identity verification, FileVault recovery key retrieval, and DM delivery with macOS-specific instructions.

Recovering Device Access and Work Account Access in One Flow

An employee is locked out of their laptop AND needs their Okta password reset (they'd been locked out for a few days). With password reset enabled in the workflow config, Harmony delivers the device recovery key and simultaneously resets the Okta password, sending the temporary credentials in the same DM exchange - one conversation, both problems solved.

Security-Conscious Environment Requiring Key Expiry

IT requires that recovery keys never persist in chat logs after use. With message expiry enabled, the recovery key DM is automatically replaced with an expiry notice after 1 hour - so the sensitive key doesn't remain accessible in the employee's chat history indefinitely.

Integrations

Integration	Role in the agent flow
Asset Management API (internal)	Source of device records (assigned devices per employee) and recovery keys (BitLocker/FileVault)
MDM / Device Management (internal)	Upstream data source - recovery keys synced into asset management from the MDM
Identity Provider (IdP)	Used for OTP-based identity verification; optionally used for simultaneous password reset
Service Desk (internal)	Ticket created at request time; updated throughout; resolved on successful key delivery or escalated
Notifications system (Slack/Teams)	Delivers OTP for identity verification; sends recovery key and optional temporary password via DM

FAQ

It's both. The AI Helpdesk chatbot handles the conversation - identifying that this is a device lockout (not an account issue), listing devices, confirming the selection, and asking for confirmation. Once the ticket is created, a deterministic workflow takes over: identity verification, key retrieval, and DM delivery.

Works alongside

More agents for the same team

All agents

ITDevice Uptime DetectionIdentifies devices that haven't restarted within policy and prompts the user to act.ITLow Storage Device DetectionProactively surfaces devices running out of storage so issues are resolved before they cause failed updates, performance degradation, or data loss.ITPrinters Health DetectionContinuously monitors the printer fleet for connectivity, toner, and maintenance issues, ensuring uptime across every location without manual oversight.

See Device Recovery on your own requests

Connect your stack and we will walk you through a real run in a 30-minute session.

Book a demo Talk to an engineer