Reset another account's two-step verification
When someone loses their authenticator, you can clear the factor for them, but only after you verify the person and prove your own authority.
Before you start
Verify the person independently, over a channel you already trust, rather than through the message that asked for the reset.
You need your own administrator account, and either an authenticator on it or a Microsoft sign-in from the last five minutes.
Reset the factor
- Open Users and select the account.
- Open the Account tab and check the two-step-verification status.
- Choose Reset two-step verification.
- Confirm the named target in the confirmation dialog.
- Prove your own authority with Use my password: your current password, plus a new unused authenticator code if your account has the factor.
- Or choose Use my recent Microsoft sign-in, which needs a Microsoft sign-in from the last five minutes; otherwise sign out and sign in with Microsoft again.
Warning: There are no recovery codes, no self-reset, no hidden commands and no recovery from the CLI. A lone administrator who loses the authenticator and has neither another administrator nor a usable Microsoft sign-in has no supported recovery, so arrange one of those before enabling verification.
What the reset does
A successful reset disables the target's factor, cancels pending verification and signs out all their browser sessions.
Their next password sign-in no longer asks for a code, and they must enrol again under Account → Security. Their API tokens and paired computers are unchanged.
If it does not work
- Stale state: reload the account and retry. An uncertain result is not a confirmed reset.
- You are impersonating: an impersonated session cannot perform the reset. Return to your own account first.
- The code prompt returns: the reset did not complete, so do not tell the person it did.
- Your Microsoft proof is old: sign in with Microsoft again, then repeat the reset.