# IdP MFA Reset

**Categories:** Identity

Securely restores access for users who have lost or replaced their authentication device, with identity verification and guided re-enrollment built in

- Triggered when a user requests an MFA reset
- Verifies the requester's identity through a secure authentication step
- Resets all MFA factors in the identity provider, forcing re-enrollment
- Terminates active sessions to immediately cut off access from the previous device
- Notifies the user through their preferred communication channel with re-enrollment instructions
- Updates the ticket with the full outcome for audit and traceability

## What IdP MFA Reset does

IdP MFA Reset is Harmony's automated workflow for resetting an employee's multi-factor authentication (MFA) enrollment on their work account. When an employee loses their authenticator app, breaks their MFA device, or gets a new phone, they ask the helpdesk chatbot, and Harmony verifies their identity, walks them through selecting which MFA factors to remove, resets those factors directly in the identity provider, and sends re-enrollment instructions - all without requiring IT to intervene.

## Who IdP MFA Reset Is For

**Persona:** Employees who are locked out of their work account because their MFA device is unavailable, broken, or no longer working.

**Pain point:** Without this workflow, an employee who loses their MFA device has to open a ticket, wait for an IT agent to locate the account in the IdP admin console, manually revoke the MFA factors, and then tell the employee how to re-enroll. Harmony compresses the entire process into a self-service flow - the employee's identity is verified, they select what to reset, and re-enrollment instructions arrive in their DM.

## How IdP MFA Reset Works

**Trigger:** An employee tells the helpdesk chatbot they can't complete MFA (lost phone, broken authenticator, new device). The chatbot identifies the request as MFA-specific (not a password issue), asks for confirmation, and creates a high-priority ticket tagged `is_mfa_reset=true`.

1. **IdP validation** - The workflow confirms the employee has an account in the configured identity provider. If not, the ticket is escalated to IT.

2. **Identity verification** - The workflow sends the employee an OTP (one-time passcode) via their registered recovery channel to confirm their identity. Since the MFA device is unavailable, OTP is the only supported method. If verification fails or times out, the ticket is escalated.

3. **Optional approval** - If the tenant has approval enabled, the workflow routes an approval request to configured IT approvers before proceeding. If approval times out, the ticket is escalated.

4. **MFA device selection** - The workflow presents the employee's enrolled MFA factors and lets them select which ones to reset (30-minute window to respond).

**Outcome:** The selected MFA factors are revoked in the IdP. Optionally, all active sessions are also terminated (configurable). Re-enrollment instructions are sent to the employee via direct message and the ticket is resolved.

## Capabilities

- **Verify identity via OTP before resetting** - Sends a one-time passcode through the employee's registered recovery channel to confirm identity before touching any MFA factors.
- **Employee-directed factor selection** - Presents the employee's enrolled MFA devices and lets them choose which factors to reset, rather than revoking everything automatically.
- **Reset MFA factors across supported IdPs** - Revokes the selected factors directly in Okta, Microsoft Entra, Google Workspace, or JumpCloud.
- **Optional session termination** - Can revoke all active sessions in the IdP after the MFA reset (disabled by default; configurable per tenant).
- **Optional approval gate** - Supports adding an IT approval step between identity verification and factor reset (disabled by default; configurable with custom approvers, strategy, and timeout).
- **Strict separation from password resets** - The agent prompt enforces a hard distinction: MFA issues (can't pass verification after entering password) trigger this workflow; password issues trigger the password reset workflow.
- **Escalate gracefully on any failure** - If the employee has no IdP account, verification fails, approval times out, or an error occurs, the ticket is reassigned to IT with a clear explanation.

## Main use cases

**Employee with a Lost or Broken Authenticator App** - An employee gets a new phone and can no longer access their Okta authenticator app. They can enter their password but can't pass MFA. The chatbot identifies this as an MFA issue (not a password issue), verifies the employee's identity via OTP, presents their enrolled MFA factors, resets the ones they select, and sends re-enrollment instructions - without any IT agent involvement.

**Employee Who Needs to Re-Enroll MFA After a Device Replacement** - An employee's company phone was replaced and they need to set up MFA from scratch. The workflow clears the old MFA enrollment so the employee can complete fresh MFA setup on their new device.

**High-Security Tenant with Approval Required** - A company policy requires IT approval before any MFA reset, even for verified employees. After identity verification passes, the workflow sends an approval request to the IT approver team. On approval, the factor reset proceeds automatically - the IT team approves once and Harmony handles the rest.

**Employee on Multiple IdPs** - A user has accounts in both Okta and Microsoft Entra and isn't sure which one their MFA issue is with. The agent asks one clarifying question ("which work account is this for?"), identifies the correct IdP, and proceeds without ambiguity.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| Okta | MFA factor enumeration and revocation - primary supported IdP (default) |
| Microsoft Entra | MFA factor enumeration and revocation - configured per tenant |
| Google Workspace | MFA factor enumeration and revocation - configured per tenant |
| JumpCloud | MFA factor enumeration and revocation - configured per tenant |
| Service Desk (internal) | Ticket is created at request time and updated throughout; HIGH-priority ticket routing |
| Notifications system | Delivers OTP for identity verification; sends re-enrollment instructions via DM after reset |
| Approval system | Optional: routes approval request to IT approvers before proceeding (Slack or Teams) |

## FAQ

### What exactly is IdP MFA Reset - is it a bot, a workflow, or something else?

It's both. The employee talks to the AI Helpdesk chatbot to describe the problem, and the chatbot determines this is an MFA issue and asks for confirmation. Once the ticket is created, a deterministic workflow takes over: it verifies identity, handles any approval routing, executes the factor reset in the IdP, and resolves the ticket.

### How does it know what to reset - does it reset everything or let the employee choose?

The employee chooses. After identity verification, the workflow presents the employee's enrolled MFA factors (such as phone push, authenticator app, SMS) and waits for them to select which ones to reset. Only the selected factors are revoked - not the entire MFA enrollment unless the employee selects all of them.

### What does it handle and what does it hand off to a human?

Harmony handles the full loop: identity verification, optional approval, factor selection, factor revocation, optional session termination, and re-enrollment instructions. It hands off to IT if the employee has no account in the configured IdP, identity verification fails, the approval step times out, the employee doesn't select any factors within 30 minutes, or an unexpected error occurs.

### Can it reset MFA for an employee who also forgot their password?

No - MFA reset and password reset are strictly separated. If the employee can't enter their password (forgot it), the agent routes them to the Password Reset workflow instead. This workflow is only for cases where the employee knows their password but can't complete MFA verification.

### What does it need to be connected to before it works?

At minimum: an IdP integration (Okta, Microsoft Entra, Google Workspace, or JumpCloud) must be configured in tenant settings. The notifications system must be set up for OTP delivery and re-enrollment instructions. The workflow template must be explicitly enabled per tenant (disabled by default).

## Related platform features

- **AI Helpdesk Chatbot** - Entry point - detects MFA issues, asks for confirmation, calls `mfa_reset` to create the ticket and start the workflow