Help someone who is locked out

Before you start

• A role that lets you manage users, for the password and sign-in link steps. Resetting MFA also needs a role that lets you manage security settings. On a new instance only administrators can manage users. In the built-in set, administrators can manage security settings, and so can anyone an administrator has given the security analyst role, which the Roles page lists as “security_analyst”.
• Be sure it is really them. Call the person on a number you already have, or speak to them in person, before you reset anything. Do not act on an email or chat message alone.
• These steps are for people who sign in with a Zonitix password. If someone signs in through Okta, Entra or Google, their password and their MFA are fixed in that directory, not here.

Find the cause

1. 1

   Step 1: Ask what they see

   “Invalid username or password”, with a line about waiting 15 minutes: the sign-in page shows this for a wrong password, a locked account and a disabled account alike. Check the person’s status first (step 7), then go to step 2.

   They get past the password but cannot give a code or passkey: go to step 4.

Password problems

1. 2

   Step 2: Wait out a lock

   After 5 wrong passwords in a row, Zonitix locks the account for 15 minutes. The sign-in page shows the same message for a wrong password and for a locked account, so it never says which. There is no unlock button. Ask the person to wait 15 minutes and try once, carefully.

2. 3

   Step 3: Forgotten password: send a sign-in link

   Go to AdministrationUsers and find the person. Click the send button on their row (its tooltip reads “Email a sign-in link”). A window titled “Send invite to” followed by their email address asks you to confirm; click “Send invite”. They get an email with a link that works once and expires after 15 minutes. It signs them in without a password; they are still asked for their second factor.

   If email is set up, they can also do this themselves: on the sign-in page, “FORGOT PASSWORD? SIGN IN WITH MAGIC LINK”.

   To make them choose a new password as well, click the key button on their row (“Expire password: sign out everywhere and require a new password at next sign-in”) and confirm with “Expire password”.

Lost phone, passkey or codes

1. 4

   Step 4: Try a recovery code first

   On the code screen, the person clicks “Lost your device? Use a Recovery Code” and enters one of the 8-character codes they saved when they set up MFA. Each code works once. Once in, they add a new passkey or authenticator app from “My Profile”.

2. 5

   Step 5: No codes left: reset their MFA

   Go to AdministrationUsers and find the person. Click the red shield button on their row (its tooltip reads “Account security: reset MFA or revoke trusted devices”) and choose “Reset MFA”.

   The confirmation says exactly what is removed: the authenticator app, all passkeys, the recovery codes and every trusted device. Click “Reset MFA”. Zonitix then asks you to confirm your own identity (your password or passkey) before it goes ahead.

   The next time the person signs in with their password, they are taken through setting up a second factor again and get new recovery codes.

3. 6

   Step 6: A lost or stolen laptop: revoke trusted devices

   If the person still has their phone but a browser they ticked “Trust this device for 30 days” on is out of their hands, use the same shield button and choose “Revoke trusted devices”. Their MFA stays as it is; every browser asks for the second factor again. If the password may be known too, expire it as in step 3.

A disabled account

1. 7

   Step 7: Check the status

   In AdministrationUsers, look at the person’s status. Someone who is disabled, inactive or offboarded cannot sign in by any route. If that is a mistake, click the edit button on their row, set “Account Status” to “ACTIVE” and save. Switching an account back on needs a role that lets you manage security settings.

   A person showing “INVITE PENDING”, “INVITE EXPIRED” or “NOT INVITED” has never set a password. Use the send button to send or resend their invitation.

If you are the administrator who is locked out

1. 8

   Step 8: Try the two routes that need nobody else

   Forgotten password: on the sign-in page, click “FORGOT PASSWORD? SIGN IN WITH MAGIC LINK” and enter your email address. If email is set up in Zonitix, a link that works once and expires after 15 minutes is sent to the address on your account. It gets you past the password; you are still asked for your second factor.

   Lost phone or passkey: use a recovery code, as in step 4.

2. 9

   Step 9: Ask another administrator

   A second administrator can do steps 3 and 5 for you from AdministrationUsers: email you a sign-in link (their role must let them manage users) and reset your MFA (their role must let them manage security settings). Both work on the primary administrator’s row too. What nobody can do for that account is expire or set its password.

3. 10

   Step 10: If there is nobody else and you have no recovery code

   Nothing on the sign-in page gets you back in without a second factor. The setup key from your first day cannot be used again: setup refuses to run once an administrator exists. Zonitix support has no sign-in to your app unless an administrator who is already signed in grants one, so support cannot reset your password or your second factor from inside the app either.

   Contact Zonitix support by email, from the address on your account, and say exactly what you have lost. We publish no recovery procedure and make no promise for this case, so do not plan on one. Plan on the two things that prevent it: a second administrator (Add your admins) and your recovery codes kept in your company password manager.

What you should see

If something goes wrong

The shield button is greyed out and says "Access Restricted"

Your role does not let you manage security settings. Ask an administrator to reset the person's MFA.

The key button is greyed out

Hover over it. Either the account signs in through a directory (reset the password there), it is the primary administrator, or your role does not let you manage users.

You are the one locked out, and you are the only administrator

Follow steps 8 to 10 above, in order: the sign-in link and a recovery code first, then another administrator. Step 10 says plainly what is left if neither is possible.

The person never receives the sign-in link

Check that email is set up under Security Settings, Email / SMTP, and ask them to look in their spam folder. A link is only sent to an active account.

Still stuck? See When something goes wrong, or Contact Zonitix support.

Where next

• Check and adjust MFA
• Password policy and sessions
• When your main administrator leaves
• Add users
• Set up email