> For the complete documentation index, see [llms.txt](https://docs.harmony.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.harmony.io/ai-agents/access-control/idp-mfa-reset.md).

# IdP MFA Reset

The **MFA Device Reset** agent automates MFA resets for identity provider users with identity verification and re-enrollment instructions.

![MFA Device Reset agent overview](/files/3avyomMNWOSUwKIdMlYX)

### What it does

* Triggered when a user requests an MFA reset
* Verifies user identity via one-time password (OTP) sent to the employee's email
* Presents the user with an interactive list of their enrolled MFA devices so they can select only the ones to remove
* Resets selected MFA factors for the user in their identity provider, leaving any unselected devices intact
* Terminates all active sessions for the user across configured identity providers
* Sends text notification via Slack, Teams, or email based on user preferences
* Updates the ticket with status and outcome

### Triggers

**Event** - Runs when agent detects MFA Reset Request made by user.

### Approval

No approval required. The agent uses identity verification instead of approval workflow.

### Configuration

#### Identity Verification

Verify the employee's identity before resetting their MFA. The agent uses:

* **One-Time Password (OTP)** - A one-time password is sent to the user's primary email address, and secondary email if available. The user must enter this code when prompted via direct message to verify their identity.

#### MFA Reset Target

Select the identity provider where MFA factors will be reset:

* **Okta** - Reset MFA factors in Okta identity provider. After the reset, the user receives a sign-in URL to re-enroll.
* **Microsoft Entra ID** - Reset MFA factors in Microsoft Entra (formerly Azure AD). Clears registered authentication methods and revokes active sessions.
* **Google Workspace** - Reset MFA factors in Google Workspace.
* **JumpCloud** - Reset MFA factors in JumpCloud. The agent supports the following factor types:
  * **TOTP (authenticator app)** - List and reset time-based one-time password devices.
  * **Push notifications** - List and reset push-based MFA devices.
  * **Combined TOTP + push** - Reset multiple factor types in a single workflow.

The agent supports Okta, Microsoft Entra, Google Workspace, and JumpCloud identity providers. It automatically discovers the employee's IdP integrations and terminates sessions across all configured providers.

#### Selective Device Removal

When a reset is triggered, the agent sends the user an interactive notification listing all of their enrolled MFA devices. The user can select only the specific devices they want removed using a multi-select prompt delivered directly in Slack or Microsoft Teams - no need to leave their existing workflow. The agent then removes only the selected devices, leaving any others intact and reducing the risk of unnecessary disruption.

#### Revoke All Sessions

Optionally revoke all active user sessions after resetting MFA factors for enhanced security. This ensures that any potentially compromised sessions are immediately invalidated as part of the reset flow.

<table data-card-size="large" data-view="cards"><thead><tr><th></th><th></th><th data-hidden data-card-target data-type="content-ref"></th></tr></thead><tbody><tr><td><strong>Working with AI Agents</strong></td><td>Learn how to run and monitor agents</td><td><a href="/pages/nVXQ6tXIMhmQI60Zi7n0">/pages/nVXQ6tXIMhmQI60Zi7n0</a></td></tr><tr><td><strong>Configuring AI Agents</strong></td><td>Configure verification and delivery</td><td><a href="/pages/8aw9tIO2tq7XtK33Enjz">/pages/8aw9tIO2tq7XtK33Enjz</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.harmony.io/ai-agents/access-control/idp-mfa-reset.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.