IdP MFA Reset

Automated MFA device reset with identity verification and re-enrollment instructions.

The MFA Device Reset agent automates MFA resets for identity provider users with identity verification and re-enrollment instructions.

MFA Device Reset agent overview

What it does

• Triggered when a user requests an MFA reset
• Verifies user identity via one-time password (OTP) sent to the employee's email
• Presents the user with an interactive list of their enrolled MFA devices so they can select only the ones to remove
• Resets selected MFA factors for the user in their identity provider, leaving any unselected devices intact
• Terminates all active sessions for the user across configured identity providers
• Sends text notification via Slack, Teams, or email based on user preferences
• Updates the ticket with status and outcome

Triggers

Event - Runs when agent detects MFA Reset Request made by user.

Approval

No approval required. The agent uses identity verification instead of approval workflow.

Configuration

Identity Verification

Verify the employee's identity before resetting their MFA. The agent uses:

• One-Time Password (OTP) - A one-time password is sent to the user's primary email address, and secondary email if available. The user must enter this code when prompted via direct message to verify their identity.

MFA Reset Target

Select the identity provider where MFA factors will be reset:

• Okta - Reset MFA factors in Okta identity provider. After the reset, the user receives a sign-in URL to re-enroll.
• Microsoft Entra ID - Reset MFA factors in Microsoft Entra (formerly Azure AD). Clears registered authentication methods and revokes active sessions.
• Google Workspace - Reset MFA factors in Google Workspace.
• JumpCloud - Reset MFA factors in JumpCloud. The agent supports the following factor types:

  • TOTP (authenticator app) - List and reset time-based one-time password devices.
  • Push notifications - List and reset push-based MFA devices.
  • Combined TOTP + push - Reset multiple factor types in a single workflow.

The agent supports Okta, Microsoft Entra, Google Workspace, and JumpCloud identity providers. It automatically discovers the employee's IdP integrations and terminates sessions across all configured providers.

Selective Device Removal

When a reset is triggered, the agent sends the user an interactive notification listing all of their enrolled MFA devices. The user can select only the specific devices they want removed using a multi-select prompt delivered directly in Slack or Microsoft Teams - no need to leave their existing workflow. The agent then removes only the selected devices, leaving any others intact and reducing the risk of unnecessary disruption.

Revoke All Sessions

Optionally revoke all active user sessions after resetting MFA factors for enhanced security. This ensures that any potentially compromised sessions are immediately invalidated as part of the reset flow.

Working with AI Agents

Learn how to run and monitor agents

Configuring AI Agents

Configure verification and delivery