# Device Recovery

**Categories:** Hardware Management

Automated device recovery with identity verification and recovery key delivery.

- Triggered when a user requests device recovery
- Verifies the requester's identity through a secure authentication step
- Retrieves the device recovery key from the connected device management system
- Delivers the recovery key to the user through their preferred communication channel
- Updates the ticket with the full outcome for audit and traceability

## What Device Recovery does

Device Recovery is Harmony's automated workflow for restoring access to a locked company-issued laptop or desktop. When an employee is locked out of their physical device - whether due to disk encryption (BitLocker, FileVault) or a forgotten device password - they ask the helpdesk chatbot, Harmony verifies their identity, retrieves the device's recovery key from asset management, and delivers it via direct message. Optionally, it simultaneously resets the employee's IdP password and automatically expires the recovery key message after one hour for security.

## Who Device Recovery Is For

**Persona:** Employees who can't log into their company-issued laptop or desktop.

**Pain point:** Device lockouts - especially encrypted disk lockouts - require an IT agent to look up the recovery key in the MDM or encryption management system, verify the employee's identity, and deliver the key securely. This is a slow, high-touch process for what is often a self-solvable problem. Harmony handles the identity verification, key retrieval, and secure delivery automatically.

## How Device Recovery Works

**Trigger:** An employee tells the helpdesk chatbot they're locked out of their laptop or computer. The chatbot distinguishes device lockouts from work account issues (password/MFA), and routes device issues here.

1. **Device identification** - The chatbot calls list_user_devices to fetch the employee's assigned devices and presents them. If the employee has multiple devices, they choose which one. The chatbot always confirms the selected device before proceeding.

2. **Ticket creation** - A recovery request ticket is created with the device asset ID. The chatbot routes the request to the workflow.

3. **Identity verification** - The workflow verifies the employee via OTP or Okta Verify. If verification fails or times out, the ticket is escalated to IT.

4. **Recovery key retrieval** - On successful verification, the workflow fetches the device's recovery key from asset management, including OS type and device name.

5. **Secure delivery** - The recovery key is sent to the employee via direct message (never in ticket comments) using a template that includes device name and OS-specific instructions.

6. **Optional password reset** - If configured, the workflow also resets the employee's IdP password and delivers the temporary password via DM.

**Outcome:** If configured, the recovery key DM is automatically overwritten after 1 hour with a message indicating the key has expired, preventing the sensitive key from persisting in the chat history.

## Capabilities

- **Device identification and selection** - Lists the employee's assigned devices and requires them to confirm which device needs recovery before any action is taken.
- **Verify identity before delivering recovery key** - Sends an OTP or uses Okta Verify to confirm the employee's identity before the recovery key is retrieved.
- **Retrieve device recovery key from asset management** - Fetches the encryption recovery key (BitLocker/FileVault) for the selected device.
- **Deliver recovery key via DM only** - Sends the recovery key exclusively via Slack or Teams DM, with OS-specific instructions - never included in ticket comments.
- **Optional IdP password reset** - Configurable option to simultaneously reset the employee's IdP password after key delivery, so both the device and work account access are restored in a single flow.
- **Automatic recovery key message expiry** - Configurable option to overwrite the recovery key DM after 1 hour with an expiry notice, removing the sensitive key from the chat history.
- **Strict scope enforcement** - The agent prompt strictly separates device lockouts from work account issues (Okta, Entra, Google Workspace) and routes each to the appropriate workflow.
- **Escalate gracefully on any failure** - If verification fails, the key can't be retrieved, or an error occurs, the ticket is reassigned to IT with a clear explanation.

## Main use cases

**Employee Locked Out of Their Encrypted Laptop** - An employee's Windows laptop is showing the BitLocker recovery screen and they don't know their recovery key. The chatbot confirms it's a device (not account) lockout, lists the employee's assigned devices, confirms the correct laptop, verifies identity via OTP, retrieves the BitLocker recovery key from asset management, and sends it via DM with Windows-specific unlock instructions.

**Employee Who Forgot Their Mac Login Password** - An employee can't log into their MacBook Pro because they've forgotten their device password. FileVault is enabled. The same flow applies - identity verification, FileVault recovery key retrieval, and DM delivery with macOS-specific instructions.

**Recovering Device Access and Work Account Access in One Flow** - An employee is locked out of their laptop AND needs their Okta password reset (they'd been locked out for a few days). With password reset enabled in the workflow config, Harmony delivers the device recovery key and simultaneously resets the Okta password, sending the temporary credentials in the same DM exchange - one conversation, both problems solved.

**Security-Conscious Environment Requiring Key Expiry** - IT requires that recovery keys never persist in chat logs after use. With message expiry enabled, the recovery key DM is automatically replaced with an expiry notice after 1 hour - so the sensitive key doesn't remain accessible in the employee's chat history indefinitely.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| Asset Management API (internal) | Source of device records (assigned devices per employee) and recovery keys (BitLocker/FileVault) |
| MDM / Device Management (internal) | Upstream data source - recovery keys synced into asset management from the MDM |
| Identity Provider (IdP) | Used for OTP-based identity verification; optionally used for simultaneous password reset |
| Service Desk (internal) | Ticket created at request time; updated throughout; resolved on successful key delivery or escalated |
| Notifications system (Slack/Teams) | Delivers OTP for identity verification; sends recovery key and optional temporary password via DM |

## FAQ

### What exactly is Device Recovery - is it a bot, a workflow, or something else?

It's both. The AI Helpdesk chatbot handles the conversation - identifying that this is a device lockout (not an account issue), listing devices, confirming the selection, and asking for confirmation. Once the ticket is created, a deterministic workflow takes over: identity verification, key retrieval, and DM delivery.

### Does the recovery key appear in the ticket thread?

No. The recovery key is sent exclusively via direct message (Slack or Teams DM) and never included in ticket comments. With the message expiry option enabled, even the DM is overwritten after 1 hour.

### What does it handle and what does it hand off to a human?

Harmony handles device identification, identity verification, key retrieval, and delivery end-to-end. It hands off to IT if: the employee can't be verified; the recovery key can't be retrieved from asset management; or an unexpected error occurs.

### Can it help if the device isn't showing a recovery screen - just forgotten password?

Yes, as long as the device is company-owned and registered in asset management with a recovery key. For macOS, FileVault recovery keys can unlock the device even when the login password is forgotten; the same applies to BitLocker on Windows.

### What does it need to be connected to before it works?

Asset management must have the employee's device assigned and a recovery key stored (synced from the MDM). The notifications system must be configured for OTP delivery and DM delivery of the recovery key. The workflow template must be explicitly enabled per tenant (disabled by default).

## Related platform features

- **Asset Management** - Data source - device records, employee-device assignments, and recovery keys are all stored and retrieved from here