Device Recovery
Automated device recovery with identity verification and recovery key delivery.
- Triggered when a user requests device recovery
- Verifies the requester's identity through a secure authentication step
- Retrieves the device recovery key from the connected device management system
- Delivers the recovery key to the user through their preferred communication channel
- Updates the ticket with the full outcome for audit and traceability
What Device Recovery does
Device Recovery is Harmony's automated workflow for restoring access to a locked company-issued laptop or desktop. When an employee is locked out of their physical device - whether due to disk encryption (BitLocker, FileVault) or a forgotten device password - they ask the helpdesk chatbot, Harmony verifies their identity, retrieves the device's recovery key from asset management, and delivers it via direct message. Optionally, it simultaneously resets the employee's IdP password and automatically expires the recovery key message after one hour for security.
Who Device Recovery Is For
Employees who can't log into their company-issued laptop or desktop.
Device lockouts - especially encrypted disk lockouts - require an IT agent to look up the recovery key in the MDM or encryption management system, verify the employee's identity, and deliver the key securely. This is a slow, high-touch process for what is often a self-solvable problem. Harmony handles the identity verification, key retrieval, and secure delivery automatically.
How Device Recovery Works
An employee tells the helpdesk chatbot they're locked out of their laptop or computer. The chatbot distinguishes device lockouts from work account issues (password/MFA), and routes device issues here.
- Device identification
The chatbot calls
list_user_devicesto fetch the employee's assigned devices and presents them. If the employee has multiple devices, they choose which one. The chatbot always confirms the selected device before proceeding. - Ticket creation
A recovery request ticket is created with the device asset ID. The chatbot routes the request to the workflow.
- Identity verification
The workflow verifies the employee via OTP or Okta Verify. If verification fails or times out, the ticket is escalated to IT.
- Recovery key retrieval
On successful verification, the workflow fetches the device's recovery key from asset management, including OS type and device name.
- Secure delivery
The recovery key is sent to the employee via direct message (never in ticket comments) using a template that includes device name and OS-specific instructions.
- Optional password reset
If configured, the workflow also resets the employee's IdP password and delivers the temporary password via DM.
If configured, the recovery key DM is automatically overwritten after 1 hour with a message indicating the key has expired, preventing the sensitive key from persisting in the chat history.
Capabilities
- Device identification and selection - Lists the employee's assigned devices and requires them to confirm which device needs recovery before any action is taken.
- Verify identity before delivering recovery key - Sends an OTP or uses Okta Verify to confirm the employee's identity before the recovery key is retrieved.
- Retrieve device recovery key from asset management - Fetches the encryption recovery key (BitLocker/FileVault) for the selected device.
- Deliver recovery key via DM only - Sends the recovery key exclusively via Slack or Teams DM, with OS-specific instructions - never included in ticket comments.
- Optional IdP password reset - Configurable option to simultaneously reset the employee's IdP password after key delivery, so both the device and work account access are restored in a single flow.
- Automatic recovery key message expiry - Configurable option to overwrite the recovery key DM after 1 hour with an expiry notice, removing the sensitive key from the chat history.
- Strict scope enforcement - The agent prompt strictly separates device lockouts from work account issues (Okta, Entra, Google Workspace) and routes each to the appropriate workflow.
- Escalate gracefully on any failure - If verification fails, the key can't be retrieved, or an error occurs, the ticket is reassigned to IT with a clear explanation.
Main use cases
Employee Locked Out of Their Encrypted Laptop - An employee's Windows laptop is showing the BitLocker recovery screen and they don't know their recovery key. The chatbot confirms it's a device (not account) lockout, lists the employee's assigned devices, confirms the correct laptop, verifies identity via OTP, retrieves the BitLocker recovery key from asset management, and sends it via DM with Windows-specific unlock instructions.
Employee Who Forgot Their Mac Login Password - An employee can't log into their MacBook Pro because they've forgotten their device password. FileVault is enabled. The same flow applies - identity verification, FileVault recovery key retrieval, and DM delivery with macOS-specific instructions.
Recovering Device Access and Work Account Access in One Flow - An employee is locked out of their laptop AND needs their Okta password reset (they'd been locked out for a few days). With password reset enabled in the workflow config, Harmony delivers the device recovery key and simultaneously resets the Okta password, sending the temporary credentials in the same DM exchange - one conversation, both problems solved.
Security-Conscious Environment Requiring Key Expiry - IT requires that recovery keys never persist in chat logs after use. With message expiry enabled, the recovery key DM is automatically replaced with an expiry notice after 1 hour - so the sensitive key doesn't remain accessible in the employee's chat history indefinitely.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Asset Management API (internal) | Source of device records (assigned devices per employee) and recovery keys (BitLocker/FileVault) |
| MDM / Device Management (internal) | Upstream data source - recovery keys synced into asset management from the MDM |
| Identity Provider (IdP) | Used for OTP-based identity verification; optionally used for simultaneous password reset |
| Service Desk (internal) | Ticket created at request time; updated throughout; resolved on successful key delivery or escalated |
| Notifications system (Slack/Teams) | Delivers OTP for identity verification; sends recovery key and optional temporary password via DM |
FAQ
It's both. The AI Helpdesk chatbot handles the conversation - identifying that this is a device lockout (not an account issue), listing devices, confirming the selection, and asking for confirmation. Once the ticket is created, a deterministic workflow takes over: identity verification, key retrieval, and DM delivery.
Meet more Agents
