How are your Help Desks verifying the identity of end-users prior performing activities like password and MFA factor resets?
Sort by:
How are you verifying that the person on the phone is who they say they are? Isn't that how MGM got popped? In an enterprise with more than one location that's going to be a problem.
Hi Doug,<br>As the comment said - "Via their Supervisor/Manager"<br>They verify their identity first.<br>The supervisor/manager works directly with them on a daily basis and would know if it's them or not.
Help Desk Teams are verifying the identity of end-users prior to performing activities like password and MFA resets via a few ways. Some utilize another form of 2FA or MFA as users are usually required to have a few ways of identity verification like something you know, something you have, or something you are. Self-Service Password Reset (SSPR) allows users to reset passwords on their own using predefined verification methods, which helps lower these help desk requests. We love conditional access policies to enforce verification steps based on the user’s location, device, or risk level. Verify explicitly by always using strong authentication methods and ensuring compliance before authorizing.
Challenge questions.
We don't have nor do we want self service password resets.
We require challenge question responses via in-person (preferred) or phone via their manager/supervisor.