Administration
Password recovery
Recovery paths for an account whose mailbox is inaccessible.
Updated:
Contents
A conventional password reset sends a link to the user's e-mail address. Where that address is the inaccessible mailbox, the link cannot be retrieved. Two recovery paths are provided outside the mail service.
Users in an organisation: administrator request
The login screen provides a password recovery option. The request is sent to the administrators of the organisation, who set a new password and communicate it through an existing channel.
The notification sent to administrators contains no reset link. Administrators complete the operation from the administration panel using their existing session.
Organisation owners: recovery address
An address outside the organisation's own domain can be configured in Settings → Profile. A reset link is delivered to that address. This path covers the owner of an organisation with no other administrator.
The recovery address must be outside the domain. An address within the domain resolves to the inaccessible mailbox.
Properties of the reset link
- Valid for one hour and usable once
- Requires the second factor where the account has one configured
- Terminates all other sessions on the account when used
SMS as a recovery method
SMS is used as a second authentication factor and is therefore not accepted for password recovery. Permitting it would allow the second factor to bypass itself, and a SIM reassignment would grant full account access.
Response to unknown addresses
The recovery form returns an identical response whether the address exists, is suspended or is not registered. The form does not disclose which addresses are in use.