Source: https://atomicwork.docs.pageloop.ai/product/ai-knowledge/skills/resetting-passwords-with-atom # Resetting passwords with Atom "I forgot my password" is one of the most common requests a service desk gets, and one of the most repetitive. Add a password reset skill to Atom and employees can reset their own work password in a conversation, any time, without waiting for an agent. There are two password reset skills, one for each identity provider: - **Azure password reset** resets an employee's Microsoft Entra ID (Azure AD / Microsoft 365) password. - **Okta password reset** unlocks an employee's Okta account if it's locked and sends them a one-time link to set a new password. ## Before you start - **Connect your identity provider.** Atom resets passwords through your Atomicwork integration with that provider, and the integration needs permission to do so: - **Microsoft Entra ID (Azure AD):** the Atomicwork app needs the **User Administrator** role. See [Azure AD: Password reset permissions](/integrations/identity-access-management/azure-ad#password-reset-permissions). - **Okta:** the API token needs the **Reset passwords** permission. See [Okta: Permissions and setup](/integrations/identity-access-management/okta#permissions-and-setup). - **Atom must be able to identify the employee.** Atom only ever resets the password of the person it's talking to, and it identifies them from their signed-in Atomicwork account. It never resets an account based on an email address someone types into the chat. ## Add the skill to Atom 1. Go to **AI Workforce > AI Registry > Skill library**. 2. Find **Azure password reset** or **Okta password reset**, and add it to Atom. Add both if your organization uses both identity providers. ## What employees see Atom picks up the skill when an employee says something like: - _"I want to reset my password."_ - _"I forgot my password."_ - _"I'm locked out."_ or _"I can't sign in to Teams."_ - _"My password expired."_ Atom then: 1. Confirms the account it's about to reset, which is always the employee's own, and asks them to go ahead. Nothing happens until they say yes. 2. Resets the password once. 3. Tells the employee what to do next. With **Azure password reset**, the employee gets a temporary password and step-by-step sign-in instructions. They sign in at microsoft365.com, signing out first if they're still in an old session, enter the temporary password, and immediately set a new one. With **Okta password reset**, Atom sends a one-time link that the employee opens to set a new password. If the account was locked, Atom unlocks it first and says so. The employee then: 1. Opens the link straight away. It works only once and expires shortly. 2. Chooses a new password. 3. Signs back in to Okta, signing out first if they're still signed in somewhere. The employee's current password keeps working until they finish, so they aren't locked out in the meantime. If they say the link didn't work, Atom asks what they saw before sending another one, because a new link cancels the previous one. ## What Atom won't do Atom resets an employee's own password and nothing else. It hands these off to your IT team, by creating a support ticket or passing the conversation to an agent: - **Resetting someone else's password.** A helpdesk or delegated reset needs proper authorization, so it isn't self-service. - **Problems with MFA or the authenticator app.** - **Hardware or VPN issues.** - **Accounts in other systems.** For example, the Azure skill doesn't unlock an account that isn't a Microsoft one, and the Okta skill doesn't unlock one that isn't an Okta account. - **Inactive Okta accounts.** If the employee's Okta account is suspended or deprovisioned, a reset won't help. Atom tells them the account isn't active and creates a ticket for IT. ## If the reset doesn't go through Atom doesn't retry a failed reset in a loop. - **Account not found:** if the employee's email doesn't match an account in your identity provider, Atom asks them to confirm their work email and tries once more. If it still fails, Atom escalates to IT. - **Reset refused or other errors:** Atom tells the employee the automated reset didn't work, without showing technical error details, and creates a ticket or hands off to an agent so IT can reset the password manually. With Okta, this can happen when your organization's self-service recovery policy, or the state of the account, stops Okta from issuing a link. - **Identity provider not connected:** if the Okta or Azure AD integration isn't connected, Atom tells the employee it can't reset the password automatically and creates a ticket for IT. ## Okta limitations | **Limitation** | **Why** | | ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Super admin passwords can't be reset. | The skill works only for non-super admins. | | The account must be **Active** or **Password expired**, and the employee must have set up a self-service recovery method in their Okta profile. | A user who was invited but hasn't joined, or whose account is in any other state, can't reset their password. See the [full list of Okta account statuses](https://help.okta.com/en-us/content/topics/users-groups-profiles/usgp-end-user-states.htm). | ## Related articles - [Okta](/integrations/identity-access-management/okta) - [Azure AD](/integrations/identity-access-management/azure-ad)