Reset authentication

Re-tagging as at the moment this sounds like a support request not a feature request.

I as an admin want to reset the account so the user can login again and can start with a new authentication.

I'm a bit confused on what is being asked. This sounds exactly like what Disabling TFA does? TFA is removed and they are able to start again without tokens hampering their login?

Could you better describe the operations workflow you are looking for to help understand what options might be available?

Sorry if I wasn't clear in my first post. I want the settings of one user to be reset not disabled.

• Disabling will disable TFA for an account. So this user can, when TFA is not enabled again, log in without TFA.
• Reset will only reset all setting so the user is forced to setup authentication again otherwise the user will be blocked after 3 times logging in without validation.

When you disable TFA and enable TFA for a user the account is reset and the user is forced to authenticate again. But this is not what I want because I want the user to be able to reset its TFA settings, for example when the user bought a new phone, without being enable to disable TFA all together. Because I want all my users to use TFA.

Hope it is more clear what I am looking for.

A quick test in my lab indicates that if a user has a role that is configured in TFA Settings as "required to set up TFA" it will enforce the counter after TFA has been disabled by an admin for that user.

A skip limit of 1 would allow a user to login and require them to setup a second factor immediately,

I also tried this but I see I had my skip limit higher than I thought. So yes this does work. What I am wondering though is what does enabling TFA do if disabling doesn't disable TFA but resets it? Maybe it is an idea to rename this option?

What I am wondering though is what does enabling TFA do if disabling doesn't disable TFA but resets it?

It does update at least one data field to mark TFA as 'enabled' for the user, though in many cases it doesn't have a direct user impact. It does cause additional internal logic to trigger that otherwise would not. It also leaves room for our logic to possibly change in the future if need be.

For users not required the disabling and enabling makes sense but for users where it is required you can't disable it you are indeed resetting the settings.

In both cases it does actually Disable TFA and causes our logic to 'bail out' early, it is just when the user role has been configured to require TFA they are forced at login to re-enable it.

Thanks for the explanation. It is clear for me what happens now and it is the feature I'm looking for.