# Password Reset Request

**Categories:** Identity

Automated password reset request with identity verification and temporary password delivery.

- Triggered when a user requests a password reset
- Verifies the requester's identity through a secure authentication step
- Resets the user's password in the identity provider with a secure temporary credential
- Requires the user to set a new password at next login
- Terminates active sessions to immediately cut off access from the previous credentials
- Delivers the temporary password to the user through their preferred communication channel
- Updates the ticket with the full outcome for audit and traceability

## What Password Reset Request does

Password Reset Request is Harmony's automated workflow for resetting an employee's work account password. When an employee can't log in because they forgot or need to change their password, they ask the helpdesk chatbot, and Harmony verifies their identity, resets the password in the identity provider, terminates active sessions, and delivers a temporary password via direct message - all within minutes and without an IT agent touching the request.

## Who Password Reset Request Is For

**Persona:** Employees who can't access their work account because of a password issue.

**Pain point:** Password resets are one of the highest-volume IT tickets in most organizations. Each one requires an agent to verify the employee, reset the account in the IdP admin console, and communicate the new credentials. Harmony automates the entire chain: identity verification, IdP reset, session cleanup, and credential delivery - freeing IT from handling these manually.

## How Password Reset Request Works

**Trigger:** An employee asks the helpdesk chatbot for a password reset. The chatbot identifies the IdP (Okta, Google Workspace, Microsoft Entra, or JumpCloud), checks account status if supported, asks for confirmation, and creates a high-priority ticket tagged `is_idp_password_reset=true`.

1. **Pre-check (account status)** - For IdPs that support status checks, the chatbot first checks whether the account is locked vs. just needing a password reset. If the account is locked and the employee remembers their password, the Account Unlock workflow is offered instead.

2. **Identity verification** - The workflow verifies the employee via OTP (one-time passcode) or Okta Verify, using recovery contact information from the IdP. Configurable per tenant; OTP fallback can be enabled. If verification fails or times out, the ticket is escalated to IT.

3. **Optional approval** - If configured, the workflow routes an approval request to IT approvers before proceeding with the reset (disabled by default).

4. **Password reset & session cleanup** - On verification (and approval if required), the workflow resets the password in the IdP and immediately terminates all active sessions.

**Outcome:** A temporary password is sent to the employee via direct message (Slack or Teams), along with the sign-in URL and instructions. The ticket is resolved and the employee is notified they must set a permanent password on first login.

## Capabilities

- **Verify identity before resetting** - Sends an OTP or uses Okta Verify (configurable per tenant) to confirm the employee's identity before touching their account. OTP fallback is supported when the primary method isn't available.
- **Check account status first** - For supported IdPs, checks whether the account is locked or the password is expired before deciding which workflow to use, and routes accordingly.
- **Reset passwords across four supported IdPs** - Resets work account passwords in Okta, Google Workspace, Microsoft Entra, and JumpCloud.
- **Terminate all active sessions after reset** - Immediately revokes all active IdP sessions after the password is reset so no unauthorized session can remain open with the old password.
- **Deliver temporary password via DM** - Sends the new temporary credentials directly to the employee's Slack or Teams DM, keeping them out of ticket comments.
- **Distinguish work accounts from personal/app accounts** - The agent strictly scopes this workflow to IdP-managed work accounts and routes personal email accounts, app-specific passwords (Salesforce, Jira, etc.), and local device passwords to appropriate alternatives.
- **Optional approval gate** - Supports an IT approval step before the reset executes (disabled by default; configurable with approvers, strategy, and timeout).
- **Escalate gracefully** - If verification fails, the approval step times out, or an error occurs, the ticket is reassigned to IT with a clear explanation.

## Main use cases

**Employee Who Forgot Their Work Password** - An employee can't log into their Okta account because they forgot their password after a vacation. The chatbot confirms this is an Okta password issue, checks that the account isn't locked (just needs a reset), asks for confirmation, verifies the employee via OTP, resets the password, terminates their sessions, and sends the temporary password via DM - resolved in one conversation.

**Employee with a Locked Account Who Also Forgot Their Password** - An employee was locked out after too many failed login attempts and has also forgotten their password. The chatbot detects the "locked" status and explains that a password reset will both reset the password and clear the lockout. The employee confirms, verification runs, the account is unlocked + reset in one operation.

**Employee Who Wants to Reset a Google Workspace Password** - An employee can't access Google Workspace (Gmail, Drive) because their password expired. The chatbot identifies the IdP from context, confirms this is a work Google account (not personal Gmail), verifies identity, resets the password, and sends credentials via DM.

**IT Admin Requesting a Password Reset on Behalf of a Colleague** - A manager calls IT to reset a colleague's account. An IT agent initiates it through the helpdesk. The workflow runs the same automated reset flow even when initiated by an IT agent - identity verification, reset, session cleanup, and credential delivery - without the agent needing to access the IdP console.

## Integrations

| Integration | Role in the agent flow |
| --- | --- |
| Okta | Work account password reset and session termination |
| Google Workspace | Work account password reset and session termination |
| Microsoft Entra | Work account password reset and session termination |
| JumpCloud | Work account password reset and session termination |
| Service Desk (internal) | HIGH-priority ticket created at request time; updated throughout the flow; resolved on success |
| Notifications system (Slack/Teams) | Delivers OTP for identity verification; sends temporary password and instructions via direct message |
| Approval system | Optional: routes approval request to IT approvers before executing the reset |

## FAQ

### What exactly is Password Reset Request - is it a bot, a workflow, or something else?

It's both. The employee talks to the AI Helpdesk chatbot, which identifies the IdP, runs the pre-checks, and asks for confirmation. Once the ticket is created, a deterministic workflow takes over: it verifies identity, runs any optional approval step, resets the password in the IdP, terminates sessions, and delivers credentials via DM.

### How does it verify the employee's identity - does it just trust whoever asks?

No. Before resetting anything, the workflow sends an OTP to the employee's registered recovery contact (fetched from the IdP) or uses Okta Verify if configured. The employee must complete this challenge before the reset proceeds. If verification fails or times out, the request is escalated to IT rather than bypassed.

### What does it handle and what does it hand off to a human?

Harmony handles the full loop for supported IdPs: verification, optional approval, reset, session termination, and credential delivery. It hands off to IT if: verification fails; the approval step times out; the account status shows "requires_escalation"; the IdP isn't one of the four supported ones; or an unexpected error occurs.

### Does the temporary password show up in the ticket thread where anyone with ticket access can see it?

No - the temporary password is sent exclusively via direct message (Slack or Teams DM) to the employee. It is not included in ticket comments.

### What does it need to be connected to before it works?

At minimum: an IdP integration (Okta, Google Workspace, Microsoft Entra, or JumpCloud) must be configured in tenant settings. The notifications system must be set up for both OTP delivery and DM delivery of the temporary password. The workflow template must be explicitly enabled per tenant (disabled by default).

## Related platform features

- **AI Helpdesk Chatbot** - Entry point - detects password issues, runs account status pre-check, and calls `idp_password_reset` to create the ticket and start the workflow