Self-service account recovery
Self-service account recovery allows active end users to reset their Okta passwords or unlock their accounts without contacting admin support.
You can configure self-service account recovery through a rule in your password policy. Or, if you want to require phishing-resistant authenticators when users perform these actions, see Okta account management policy.
Before you begin
- Enable all the authenticators that you want to use for account recovery.
- If you want to use Okta Verify for account recovery, enable the Push notification option.
- Enable extra authenticators for use in non-recovery scenarios. These should be different from the authenticators used for recovery scenarios. You can't reuse the recovery authenticators for providing additional verification.
- Set at least two non-email authenticators to Required in the authenticator enrollment policy. Okta recommends that you require users to enroll in multiple authenticators so that they have enough authenticators available for recovery and authentication.
Configure self-service account recovery
- Add a password policy.
- Optional. If you enabled the Okta account management policy feature but don't want to use it for self-service actions, set the Access control condition to Legacy.
- Configure the self-service options as needed.
Recommended configurations
Some configurations can block users from authenticating during account recovery. The following table provides examples of configurations to avoid, explanations, and recommendations on what to do instead.
|
Configuration to avoid |
Reason |
Use this configuration instead |
|---|---|---|
|
In the Admin Console, go to , select Actions and Edit for the email and phone authenticators to view the Used for setting:
In the Admin Console, go to , and click in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see the Email and Phone options to initiate the recovery. If the user selects phone, they can't complete the secondary verification because email is configured for recovery only, not for authentication. |
|
|
In the Admin Console, go to :
In the Admin Console, go to , and click in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see both the Email and Okta Verify options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because email is configured for recovery only, not for authentication. |
|
|
In the Admin Console, go to , select Actions and Edit for the email and phone authenticators to view the Used for setting:
In the Admin Console, go to , and click in the Password row. Click the pencil icon for the rule that you want to examine:
|
Users can't initiate the recovery process for this configuration because the authenticator enrollment policy doesn't require them to enroll in Okta Verify or phone. |
To use phone, Okta Verify, or both to initiate a recovery, ensure that these authenticators are set to Required in the authenticator enrollment policy. |
|
In the Admin Console, go to :
In the Admin Console, go to , and click in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see both the Phone and Okta Verify options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because phone is configured for recovery only, not for authentication. |
|
|
In the Admin Console, go to , select for the Email and Phone authenticators to view the Used for setting:
In the Admin Console, go to , and click in the Password row. Click the pencil icon for the rule that you want to examine:
|
When users attempt account recovery, they see the Okta Verify, Email, and Phone options to initiate the recovery. If the user selects Okta Verify, they can't complete the secondary verification because email and phone are configured for recovery only, not for authentication. |
|
- You can disable email and phone for password reset or account unlock.
- You can enable Security Question as an additional verification step.
- When you select the unlock option for LDAP-sourced Okta user accounts, the user account is unlocked in Okta, but it remains locked in the on-premises LDAP instance.
- Set at least two non-email authenticators to Required.
- Don't use the authenticator you select for everyday authentication for recovery.
- In self-service password reset scenarios, when you select Okta Verify with push as the only authenticator, and you've activated User Enumeration Prevention for recovery, users still receive number matching challenges even if you've turned that setting off.
Related topics
Configure the password authenticator
Configure the Okta Verify authenticator