Dual approval of authenticator resets

With dual approval, no administrator resets someone's authenticators alone: the request runs only when another administrator approves it within one hour. It protects against a compromised administrator or one fooled by social engineering.

How do I turn it on?

1. Open «Manage» › «Security» and confirm if the console asks.
2. On the «Assisted authenticator reset» card, tick «Require approval from a second administrator».
3. Choose «Save».

It can be turned on only with three administrators with a passkey. Otherwise «Could not enable it: three administrators with a passkey are required, or the setting changed. Refresh and try again.» appears.

How does a request work?

1. The first administrator does the reset as usual. «Request recorded. Awaiting approval from another administrator until 14:30.» appears.
2. Another administrator (neither the requester nor the person concerned) opens «Manage» › «Users» › «Authenticator resets».
3. They choose «Approve» on the request's row within one hour. The enrollment code appears to the approver.
4. Any authorised administrator except the person concerned can «Cancel».

States: «Pending», «Executed», «Expired», «Canceled».

When the one-hour window passes, «The request has already been decided or the one-hour approval window has ended.» appears. Do a new reset.

How do I turn it off?

Turning it off also needs another administrator. When you clear the option and save, «Request recorded: dual approval stays on until another administrator confirms switching it off.» appears. The second administrator sees the request, clears the option and saves to confirm.