> ## Documentation Index
> Fetch the complete documentation index at: https://university.triggr-app.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Reset Multi-factor Authentication
> Removes a user's registered MFA methods in your client's Microsoft 365 so they set MFA up again, and can sign them out everywhere.
Reset Multi-factor Authentication removes every sign-in method a user has registered except their password, so they set MFA up again. Use it when someone's lost or replaced the phone they use for MFA. It needs [Microsoft 365 connected](/core/get-started/connect-microsoft-365) with the `UserAuthenticationMethod.ReadWrite.All` permission, which Core requests when you connect. Under GDAP, the client's relationship also needs Authentication Administrator, or Privileged Authentication Administrator to reset an admin's MFA (see [Recommended roles](/integrations/microsoft-graph/recommended-roles)).
## What the form asks
| Field | |
| - | - |
| User | Required, always on. The account to reset, picked from the client's users |
| Sign them out everywhere now? | Optional by default, and starts on No. Yes signs the user out of every session, so they set MFA up again straight away rather than when their sessions expire |
| Reason / ticket reference | Optional by default. For your records and the approver; not sent to Microsoft |
## What it does
1. Creates a ticket in your PSA, if Ticketing is on.
2. Waits for approval, if Approval is Internal or External.
3. Reset MFA: removes every authentication method the user has registered in the client's Microsoft Entra ID except their password, such as Microsoft Authenticator, phone numbers, FIDO2 security keys, OATH tokens, email and Windows Hello for Business.
4. Sign Out Everywhere: revokes the user's sign-in sessions, if you chose Yes.
Microsoft asks the user to register MFA again at their next sign-in. In Executions, open the Reset MFA step to see the methods it removed. Authentication methods live only in Entra, so a client that syncs on-premises Active Directory resets the same way, without the desktop agent.
With Ticketing on, the ticket gets a note listing the removed methods and another when the user is signed out. With Log actions to the ticket on, it also gets a note when the run starts and when it completes. If either step fails, the run ends Failed, and with Ticketing on the ticket note says what to finish by hand in Entra.
## Configure it
Go to **Config** and click Reset Multi-factor Authentication.
| Setting | Where | What it does |
| - | - | - |
| Availability | Header | Internal only, Public form only, Internal + public or Disabled. List on homepage needs a public form. Base config only |
| User | Form config | Always on: the automation needs it |
| Sign them out everywhere now? | Form config | Hidden, Optional or Required. Hidden means no run signs the user out. Can differ per client |
| Reason / ticket reference | Form config | Hidden, Optional or Required. Can differ per client |
| Add field, Add section | Form config | Your own questions. They're saved with the request and can go in ticket templates, but aren't sent to Microsoft. Add client section asks one client only |
| Approval | Execution config | None runs on submit. Internal waits for a teammate or group; External waits for the client's approver, set on each client. Conditional overrides use a different approval when the answers match |
| Ticketing | Execution config | Create a PSA ticket for each run, with its type, priority, status, subject and body. Log actions to the ticket adds an internal or public note as each action completes |
| User directory filters | Execution config | Which users the User picker lists: licensed, active, no guests, and not in the Entra roles you exclude (for example Global Administrator). Exclude specific users at a client's scope |
Approval, Ticketing and User directory filters are set on Base config and apply to every client unless you override them for one. For how Base config and client overrides work, see [How configuration works](/core/get-started/configure-user-onboarding#settings-for-each-client).
## Troubleshooting
Microsoft refused to list or remove the user's methods. Under GDAP, the client's relationship needs Authentication Administrator assigned to Triggr's security group, or Privileged Authentication Administrator if the user holds an admin role. The run form can warn you before you submit, for example "MFA reset will fail for Acme Corp — needs Authentication Administrator."
Triggr removed the methods it could, and the message names each one it couldn't and why. Remove those in the Microsoft Entra admin center, under the user's Authentication methods.
Check User directory filters. By default the list leaves out unlicensed users, accounts whose sign-in is blocked and guests, as well as anyone in an Entra role you've excluded.
## Related
* [Workflow catalogue](/core/reference/workflow-catalogue)
* [Run a workflow](/core/use/run-a-workflow)
* [User Offboarding](/core/workflows/user-offboarding), which can also reset a leaver's MFA
* [Password Reset](/core/workflows/password-reset)
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.