Resetting Two-Factor Authentication

A person who cannot reach their authenticator app can sign in with one of their remaining recovery codes. If the codes are lost too, you reset the person's two-factor authentication from the user page. Do this only after you have confirmed the person's identity through another channel.

1. Confirm the person's identity by phone, through institutional correspondence or in person.
2. On the Administration → Users & roles screen, press the user's name.
3. On the Account actions card, press Reset two-factor authentication.
4. In the Reason (how the identity was confirmed) field, write how you confirmed the identity, in at least 5 characters.
5. Press Reset two-factor authentication in the window.

Effects of the reset

• The authenticator key and the recovery codes are deleted.
• All of the person's sessions are closed.
• The person receives an e-mail and a panel notification.
• The action is written to the audit log with its reason.

From then on, the person signs in with their password alone and turns two-factor authentication on again on the My profile → Security tab. The setup is described in Using Two-Factor Authentication.

If mandatory two-factor authentication is on and the person has an administrator or editor role, the person cannot do the work of that role until they finish the setup.

When the button does not appear

The Reset two-factor authentication button appears only on accounts that have two-factor authentication turned on. You see the state on the Two-factor authentication row of the Account card. The button does not appear on your own account either. You manage your own two-factor authentication on the Security tab.