# Reset a User's MFA
URL: https://docs.autociso.io/product/admin/reset-user-mfa/
Description: Remove all multi-factor authentication methods for a colleague who lost their phone or security key, so they can sign in and set up MFA again.

Use Reset MFA when a colleague loses their phone or security key and cannot sign in. The reset removes every multi-factor authentication (MFA) method from their account. They then sign in with their password and set up MFA again.

## Who can reset MFA

[Owners and Managers](https://docs.autociso.io/getting-started/roles-and-permissions/) can reset MFA. These limits apply:

- You cannot reset your own MFA. Ask another administrator.
- You cannot reset MFA for a user with a higher role than yours.
- You cannot reset MFA in the demo organization.
- If the person also belongs to another organization or has a partner account, only AutoCISO Support can reset their MFA. Contact support.

## Reset a user's MFA

1. Open the user menu (your name at the bottom of the sidebar).
2. Click **User Management**.
3. Find the user in the table.
4. Click **Reset MFA** in the user's row.
5. Read the dialog **Reset multi-factor authentication**.
6. Optional: enter a reason in **Reason (optional)**.
7. Click **Reset MFA**.

The message **MFA reset** confirms the result. It lists the methods that were removed.

## What the reset removes

The reset removes all of these methods:

- Authenticator apps
- Security keys
- Passkeys
- Recovery codes
- SMS codes
- Email codes

The reset does not end sessions that are already signed in. If you suspect the account is compromised, click **Disable** on the user first. Then reset MFA.

## What the user sees

The user signs in with their password only. AutoCISO does not force the user to set up MFA again. Ask the user to set up a new method right away, and confirm that they did.

The user also gets an email about the reset. The email shows:

- The name and email address of the administrator who did the reset
- The name of your organization
- The time of the reset

The email has no link. It does not include your reason. If AutoCISO Support does the reset, the email names "AutoCISO Support" instead of a person.

If the user had no MFA methods, nothing is removed and no email is sent.

## Add a reason

The reason is optional. AutoCISO stores it permanently in the [Audit Trail](https://docs.autociso.io/product/admin/audit-trail-integrity/). Nobody can erase it.

Do not enter personal data. This includes phone numbers, addresses, and health or family details. Write a short, neutral reason, for example "lost phone, new device".

## Limits

- You can do about 5 resets per hour.
- A user who is still **Invited**, and has not signed in yet, has no MFA to reset.
- You cannot reset MFA for a user with **Revoked** status.
- You can reset MFA for a **Disabled** user.

## What the Audit Trail records

Each reset adds entries to the Audit Trail. They record who asked for the reset, the result, which method types were removed, and your reason. Refused attempts are also recorded. The entries have the actions Requested, Reset and Denied, and the operation "mfaReset". Open the [Audit Trail](https://docs.autociso.io/console/settings/audit-trail/) page to review them.

## Troubleshooting

| Message | What it means | What to do |
|---|---|---|
| You cannot reset your own MFA. Ask another administrator. | You tried to reset your own account. | Ask another Owner or Manager. |
| You cannot reset MFA for this user because their access level is higher than yours or cannot be managed from this organization. | The user has a higher role than you. | Ask an administrator with an equal or higher role. |
| You do not have permission to reset MFA for users in this organization. | Your role cannot reset MFA. | Ask an Owner or Manager. |
| This user has not signed in yet, so there is no MFA to reset. | The user never completed sign-in. | Use **Retry Invitation** if the user needs a new invitation. |
| This user's access was revoked, so their MFA cannot be reset. | The user has **Revoked** status. | Invite the user again if they need access. |
| This person's sign-in account is shared with other organizations or a partner account, so only a platform administrator can reset their MFA. Contact support. | The person has more than one account link. | Contact support. |
| We could not find a verified email for this user's account, so MFA cannot be reset and nothing was changed. Contact support. | AutoCISO cannot send the notice email. | Contact support. |
| The sign-in account for this user could not be found. Contact support. | The sign-in account does not exist. | Contact support. |
| The reset did not finish. Some sign-in methods may still be active. | The reset removed some methods only. | Click **Reset MFA** again. Repeating the reset is safe. |
| The sign-in service did not respond. Nothing was changed. You can try again. | A temporary service error. | Try again. |
| The action could not be recorded in the audit trail, so nothing was changed. You can try again. | AutoCISO could not write the Audit Trail entry. | Try again. |
| Too many MFA resets. Try again in N min. | You reached the hourly limit. | Wait the number of minutes shown. |
| MFA cannot be reset in the demo organization. | The demo organization is protected. | Use your own organization. |