Resetting multi-factor authentication removes the person’s registered authentication methods, leaving their password alone. Use it when they have lost a phone, changed devices, or cannot complete the second step.

The reset signs the person out of every device when it removes at least one method. Where nothing could be removed it reports success and revokes nothing, so ask for revocation separately if that matters.

What happens next depends on whether every method was removed or only some, and that catches people out.

Before you begin

You need the permission for multi-factor authentication management, granted through your access group.

Confirm the problem is actually the second step. If the password itself is being rejected, a password reset is the right action and this one will not help.

Ask Avvi

1. Open chat.
2. Say what you want, naming the person. For example: reset MFA for jane@example.com, she has a new phone.
3. Read the confirmation and check the name and email address on it.
4. Confirm.

Avvi reports what was removed once the reset completes.

Good to know

If every removable method is taken away, the person is prompted to register a new one the next time they sign in. That is the outcome most people expect.

If a method survives, that surviving method still satisfies the second step. The person is not prompted to set up an authenticator app, and they may not notice anything changed at all.

The usual survivor is Windows Hello for Business, which cannot be removed remotely. The person has to clear that from their own device.

Verify it worked

Ask the person to sign in.

If every method was removed, they are prompted to register one. If they sign in normally with no prompt, a method survived and you should check what is still registered before assuming the reset failed.

If something doesn’t look right

If the person still cannot complete the second step after the reset, check whether the account is disabled rather than an authentication problem.

If they need access today and cannot set up a new method yet, a temporary access pass gets them working in the meantime.

If neither explains it, open a support conversation from the Help drawer. Include the client name, the person’s email address, and what they see at the point it fails.

FAQ

Q: Does this change their password?

A: No. The password is untouched. Only the authentication methods are removed.

Q: Will they be signed out?

A: Yes, on every device, provided at least one method was actually removed. A reset that removed nothing does not sign them out.

Q: They say nothing changed after the reset.

A: A method probably survived and is still satisfying the second step. Windows Hello for Business is the usual one, and only the person can clear it.