Skip to main content
Reset Multi-factor Authentication removes every sign-in method a user has registered except their password, so they set MFA up again. Use it when someone’s lost or replaced the phone they use for MFA. It needs Microsoft 365 connected with the UserAuthenticationMethod.ReadWrite.All permission, which Core requests when you connect. Under GDAP, the client’s relationship also needs Authentication Administrator, or Privileged Authentication Administrator to reset an admin’s MFA (see Recommended roles).

Reset Multi-factor Authentication in 50 seconds: what it asks, what it does and what you get.

​
What the form asks

​
What it does

  1. Creates a ticket in your PSA, if Ticketing is on.
  2. Waits for approval, if Approval is Internal or External.
  3. Reset MFA: removes every authentication method the user has registered in the client’s Microsoft Entra ID except their password, such as Microsoft Authenticator, phone numbers, FIDO2 security keys, OATH tokens, email and Windows Hello for Business.
  4. Sign Out Everywhere: revokes the user’s sign-in sessions, if you chose Yes.
Microsoft asks the user to register MFA again at their next sign-in. In Executions, open the Reset MFA step to see the methods it removed. Authentication methods live only in Entra, so a client that syncs on-premises Active Directory resets the same way, without the desktop agent. With Ticketing on, the ticket gets a note listing the removed methods and another when the user is signed out. With Log actions to the ticket on, it also gets a note when the run starts and when it completes. If either step fails, the run ends Failed, and with Ticketing on the ticket note says what to finish by hand in Entra.

​
Configure it

Go to Config and click Reset Multi-factor Authentication.

Configure Reset Multi-factor Authentication: every option, step by step (1:24).

Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see How configuration works.

​
Troubleshooting

Microsoft refused to list or remove the user’s methods. Under GDAP, the client’s relationship needs Authentication Administrator assigned to Triggr’s security group, or Privileged Authentication Administrator if the user holds an admin role. The run form can warn you before you submit, for example “MFA reset will fail for Acme Corp — needs Authentication Administrator.”
Triggr removed the methods it could, and the message names each one it couldn’t and why. Remove those in the Microsoft Entra admin center, under the user’s Authentication methods.
Check User directory filters. By default the list leaves out unlicensed users, accounts whose sign-in is blocked and guests, as well as anyone in an Entra role you’ve excluded.