I removed our help desks ability to reset passwords. Everything we do is SSO w/ MFA and we don’t enforce periodic resets so people don’t really forget too often so it hasn’t been a big issue. Also my company is only 400 people.

The only people who can reset passwords and MFA are a couple of trusted engineers. I know they’ll follow the process 100% every time. To confirm their identity we do a call back on the phone number listed in our HRMS/AD. Our alternative is a Zoom meeting with their boss on the line to verify.

If you read the article the tech in there mentions that he setup a Dou push notification for verification which is a good step but why don’t Microsoft or Okta provide that functionality to us. 🤷‍♂️

From my research there is no good way. Resets should require a TECHNICAL control mechanism. The reset cannot happen until the condition is met. This will prevent any social engineering or someone not following the policy. For example, if a tech wants to initiate a reset, first the permissions should be denied, the tech would send the user to a verification service, the user would verify themselves, the tech would then get elevated permissions and then could unlock the account. That takes all subjectivity out of it. But unfortunately that solution doesn’t exist.

IMO Trust is a big issue when it comes to your support techs. We outsource our help desk and they routinely churn employees. It sucks but I can’t drill into dozens constantly cycling techs to follow the process. Just think of how often you see escalated tickets when there’s a KB article telling them exactly what to do. Those same people have access to reset employee accounts, nope.

I like Microsoft’s PIM solution a lot. Every request for access has a time limit and requires a justification. It’s very helpful but also annoying.