Reset a User's Authenticator
Goal
Get a colleague back in when their authenticator app is gone — a lost or replaced phone, an app uninstalled, recovery codes never saved — without touching their password.
Before you start
You need the PlatformAdmin role, and you must have signed in with your own authenticator code recently. This is the one action that opens a door in somebody else's account, so the platform asks the administrator to prove it is really them: within a few minutes of a sign-in with a code it just works; after that, sign in again and come back.
Steps
- Open Admin Control Center → Users. The Authenticator column says On for anybody with an app enrolled, and Not set up otherwise.
- Select the person — one row. Reset authenticator is enabled only for somebody whose column says On: there is nothing to reset otherwise.
- Press Reset authenticator, read the confirmation, and confirm.
- Tell them to sign in again with their password. Instead of a code prompt they get the authenticator set-up screen, exactly as on their first day.
What happens
- Their old app entry stops working, and so do their old recovery codes — the reset starts from a new secret the old device never saw.
- Every session and refresh token they had is signed out.
- Nothing about their password changes.
- The reset is written to the platform's log with your account against it.
When not to do this
- "I don't have my phone with me today." That is what recovery codes are for; a reset throws away a working enrolment. If they have no codes either, this is the only way — but say so.
- To skip a code for yourself. You can reset your own authenticator here, and it is the honest way to move to a new phone — but you will be enrolling again immediately after.
Troubleshooting
"Prove it is you" (mfa.step_up.required). Your own sign-in was too long ago. Sign out, sign
in with your code, and do it again.
The button is disabled. Either more than one row is selected, or the person has no authenticator to reset — check the Authenticator column.