A lost phone is replaced with a new authenticator
Who is involved
| Role | What they do |
|---|---|
| Employee | Lost the phone and the backup codes. |
| Tenant admin | Confirms identity and removes the old authenticator. |
Step by step
- Employee
Contacts the administrator by a trusted channel.
What they see:Nothing changes yet.
- Tenant admin
Confirms who is asking, then opens Settings, Users and the row's Remove authenticator action.
What they see:A warning says this lowers the account's protection until the person enrols again.
- Tenant admin
Confirms.
What they see:The authenticator and backup codes are cleared and a critical audit entry is written.
- Employee
Opens My profile, Security and enrols a new authenticator by scanning the QR code.
What they see:Ten new backup codes are shown once.
- Employee
Saves the codes somewhere safe.
What they see:The profile shows the authenticator as enabled.
Who is told what
No automatic notice is sent for the removal. Every password sign-in of someone who has an authenticator app asks for its code, so a removal matters most for platform operators and for people your company requires to use one; a platform operator's own recovery is done by another operator from Platform, Users.