IdP MFA Reset
Securely restores access for users who have lost or replaced their authentication device, with identity verification and guided re-enrollment built in
- Triggered when a user requests an MFA reset
- Verifies the requester's identity through a secure authentication step
- Resets all MFA factors in the identity provider, forcing re-enrollment
- Terminates active sessions to immediately cut off access from the previous device
- Notifies the user through their preferred communication channel with re-enrollment instructions
- Updates the ticket with the full outcome for audit and traceability
What IdP MFA Reset does
IdP MFA Reset is Harmony's automated workflow for resetting an employee's multi-factor authentication (MFA) enrollment on their work account. When an employee loses their authenticator app, breaks their MFA device, or gets a new phone, they ask the helpdesk chatbot, and Harmony verifies their identity, walks them through selecting which MFA factors to remove, resets those factors directly in the identity provider, and sends re-enrollment instructions - all without requiring IT to intervene.
Who IdP MFA Reset Is For
Employees who are locked out of their work account because their MFA device is unavailable, broken, or no longer working.
Without this workflow, an employee who loses their MFA device has to open a ticket, wait for an IT agent to locate the account in the IdP admin console, manually revoke the MFA factors, and then tell the employee how to re-enroll. Harmony compresses the entire process into a self-service flow - the employee's identity is verified, they select what to reset, and re-enrollment instructions arrive in their DM.
How IdP MFA Reset Works
An employee tells the helpdesk chatbot they can't complete MFA (lost phone, broken authenticator, new device). The chatbot identifies the request as MFA-specific (not a password issue), asks for confirmation, and creates a high-priority ticket tagged is_mfa_reset=true.
- IdP validation
The workflow confirms the employee has an account in the configured identity provider. If not, the ticket is escalated to IT.
- Identity verification
The workflow sends the employee an OTP (one-time passcode) via their registered recovery channel to confirm their identity. Since the MFA device is unavailable, OTP is the only supported method. If verification fails or times out, the ticket is escalated.
- Optional approval
If the tenant has approval enabled, the workflow routes an approval request to configured IT approvers before proceeding. If approval times out, the ticket is escalated.
- MFA device selection
The workflow presents the employee's enrolled MFA factors and lets them select which ones to reset (30-minute window to respond).
The selected MFA factors are revoked in the IdP. Optionally, all active sessions are also terminated (configurable). Re-enrollment instructions are sent to the employee via direct message and the ticket is resolved.
Capabilities
- Verify identity via OTP before resetting - Sends a one-time passcode through the employee's registered recovery channel to confirm identity before touching any MFA factors.
- Employee-directed factor selection - Presents the employee's enrolled MFA devices and lets them choose which factors to reset, rather than revoking everything automatically.
- Reset MFA factors across supported IdPs - Revokes the selected factors directly in Okta, Microsoft Entra, Google Workspace, or JumpCloud.
- Optional session termination - Can revoke all active sessions in the IdP after the MFA reset (disabled by default; configurable per tenant).
- Optional approval gate - Supports adding an IT approval step between identity verification and factor reset (disabled by default; configurable with custom approvers, strategy, and timeout).
- Strict separation from password resets - The agent prompt enforces a hard distinction: MFA issues (can't pass verification after entering password) trigger this workflow; password issues trigger the password reset workflow.
- Escalate gracefully on any failure - If the employee has no IdP account, verification fails, approval times out, or an error occurs, the ticket is reassigned to IT with a clear explanation.
Main use cases
Employee with a Lost or Broken Authenticator App - An employee gets a new phone and can no longer access their Okta authenticator app. They can enter their password but can't pass MFA. The chatbot identifies this as an MFA issue (not a password issue), verifies the employee's identity via OTP, presents their enrolled MFA factors, resets the ones they select, and sends re-enrollment instructions - without any IT agent involvement.
Employee Who Needs to Re-Enroll MFA After a Device Replacement - An employee's company phone was replaced and they need to set up MFA from scratch. The workflow clears the old MFA enrollment so the employee can complete fresh MFA setup on their new device.
High-Security Tenant with Approval Required - A company policy requires IT approval before any MFA reset, even for verified employees. After identity verification passes, the workflow sends an approval request to the IT approver team. On approval, the factor reset proceeds automatically - the IT team approves once and Harmony handles the rest.
Employee on Multiple IdPs - A user has accounts in both Okta and Microsoft Entra and isn't sure which one their MFA issue is with. The agent asks one clarifying question ("which work account is this for?"), identifies the correct IdP, and proceeds without ambiguity.
Integrations
| Integration | Role in the agent flow |
|---|---|
| Okta | MFA factor enumeration and revocation - primary supported IdP (default) |
| Microsoft Entra | MFA factor enumeration and revocation - configured per tenant |
| Google Workspace | MFA factor enumeration and revocation - configured per tenant |
| JumpCloud | MFA factor enumeration and revocation - configured per tenant |
| Service Desk (internal) | Ticket is created at request time and updated throughout; HIGH-priority ticket routing |
| Notifications system | Delivers OTP for identity verification; sends re-enrollment instructions via DM after reset |
| Approval system | Optional: routes approval request to IT approvers before proceeding (Slack or Teams) |
FAQ
It's both. The employee talks to the AI Helpdesk chatbot to describe the problem, and the chatbot determines this is an MFA issue and asks for confirmation. Once the ticket is created, a deterministic workflow takes over: it verifies identity, handles any approval routing, executes the factor reset in the IdP, and resolves the ticket.
Meet more Agents
