Self-service account recovery
Self-service account recovery allows active end users to reset their Okta passwords or unlock their accounts without contacting admin support.
You can configure self-service account recovery through a rule in your password policy.
Before you begin
Enable the Password authenticator and any other authenticators that users can use for account recovery.
Configure self-service account recovery
- In the Admin Console, go to Security > Authenticators.
- In the Password row, click Actions > Edit.
- In an existing password policy, click Add Rule or edit an existing rule.
-
Configure these options as needed:
- IF User’s IP is – Specify whether Anywhere, In zone, or Not in zone invokes the rule.
- THEN User can perform self-service:
- Password change (from account settings) - Users can change their password once they’ve authenticated with their password and another factor (if enrolled).
- Password reset - Users can reset a forgotten password by verifying with any authenticator that is configured in recovery settings.
- Unlock account - Users can unlock their account by verifying with any authenticator that is configured in recovery settings.
- AND Users can initiate recovery with:
- Okta Verify (Push notification only)
- Phone (SMS / Voice Call)
- AND Additional verification is:
- Not required – Users aren’t required to authenticate with a second factor.
- Any enrolled authenticator used for MFA/SSO – Users are required to authenticate with an MFA authenticator (Okta Verify, Email, Phone, or Security Key) as a second factor.
- Only Security Question – Users are required to answer a Security Question as a second factor.
-
Create or update the password policy rule to save your changes.
You can't use the same authenticator for both initiating recovery and providing additional verification. The authenticator that you select for the AND Additional verification is option must be different from the authenticator you select for the AND Users can initiate recovery with option.
Recommended configurations
Some configurations can cause users to be unable to authenticate when initiating account recovery. The following table provides examples of configurations to avoid, explanations, and recommendations on what to do instead:
|
Configuration to avoid |
Reason |
Use this configuration instead |
|---|---|---|
|
In the Admin Console, go to Security > Authenticators, select Actions and Edit for the Email and Phone authenticators to view the Used for setting:
In the Admin Console, go to Security > Authenticators, and click Actions > Edit in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see the Email and Phone options to initiate the recovery. If the user selects Phone, they can't complete the secondary verification because Email is configured for Recovery, not for Authentication. |
|
|
In the Admin Console, go to Security > Authenticators:
In the Admin Console, go to Security > Authenticators, and click Actions > Edit in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see both the Email and Okta Verify options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because Email is configured for Recovery, not for Authentication. |
|
|
In the Admin Console, go to Security > Authenticators, select Actions and Edit for the Email and Phone authenticators to view the Used for setting:
In the Admin Console, go to Security > Authenticators, and click Actions > Edit in the Password row. Click the pencil icon for the rule that you want to examine:
|
Users can't initiate the recovery process for this configuration. They aren't asked to enroll in Okta Verify or Phone because they aren't set to Required in the enrollment policy. |
To use Phone, Okta Verify or both to initiate a recovery, ensure that these authenticators are set to Required as part of the enrollment policy. |
|
In the Admin Console, go to Security > Authenticators:
In the Admin Console, go to Security > Authenticators, and click Actions > Edit in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see both the Phone and Okta Verify options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because Phone is configured for Recovery, not for Authentication. |
|
|
In the Admin Console, go to Security > Authenticators, select Actions > Edit for the Email and Phone authenticators to view the Used for setting:
In the Admin Console, go to Security > Authenticators, and click Actions > Edit in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see the Okta Verify, Email, and Phone options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because Email and Phone are configured for Recovery, not for Authentication. |
|
- Email and Phone are MFA authenticators that you can turn off for password reset or account unlock.
- Security Question can also be enabled as an additional verification step. See About MFA authenticators.
- When you select the unlock option for LDAP-sourced Okta user accounts, the user account is unlocked in Okta, but it remains locked in the on-premises LDAP instance.
- Don't set all authenticators on the Security > Authenticators page, Enrollment tab to Optional. Set at least two non-Email authenticators to Required.
- Don't use the authenticator you select for everyday authentication for recovery.
- To configure additional verification, use the Any enrolled authenticator used for MFA/SSO option: Go to Security > Authenticators > Setup, then click Actions > Edit for Password. Select the Any enrolled authenticator used for MFA/SSO option in a password policy rule.
Related topics
Configure the Password authenticator
Configure the Okta Verify authenticator