> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Enable password reset

Complete this procedure to enable users to reset their password during authentication.

### Configure password reset

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** page appears.

2. Select **Password Reset**. The **Password Reset** settings appear.

3. Select the **Named Password** you want to configure for password reset.

4. Select **Enable Forgot Password** to enable users to reset their password during authentication.

note
You must also modify your IDaaS resource rules to enable password reset. See [Manage password reset](/docs/authentication-and-security/manage-authenticators/manage-password-reset.md) for more information.

5. From **Second Factor Authenticators Allowed to perform a Password Reset**, select the second-factor authentication methods to allow. Keep the following behavior in mind:

   1. Drag and drop the selected methods in order of preference.
   2. During password reset, users are prompted to complete the method at the top of the list first.
   3. If a user does not have that method, they are prompted to use the next method in the list.
   4. If a user does not have any listed methods, they cannot reset their password.

warning
Password reset is an account recovery flow. Review the allowed second-factor list before enabling password reset broadly. If you include lower-assurance methods such as email OTP, SMS OTP, voice OTP, Magic Link, or KBA, users who do not have a stronger listed authenticator might be able to reset passwords with those methods.

note
Selecting **Temporary Access Code** as an allowed authenticator only lets users complete a Temporary Access Code challenge to reset a password. A Temporary Access Code cannot be used to satisfy a required Grid Card, OTP, or Token challenge before password reset.

6. Optional: Select **Additional second-factor**.

   Users must complete second-factor authentication before they can reset their password. If you enable **Should we ask for an additional second-factor when resetting a password?**, users must complete two second-factor authentication challenges from the allowed second-factor list.

warning
**Password Reset** requires only one second-factor authenticator by default. Entrust recommends enabling this option so users must complete two second-factor authenticators when resetting a password.

This password reset second-factor policy does not apply to the Entrust Identity app. For details, see the [Entrust Identity app documentation](https://www.entrust.com/resources/identity-and-access-management/support/entrust-identity-app).

7. Select **Unlock User Account** to unlock the user's account and prompt the user to optionally reset their password.

8. Select **Send user account lock/unlock email notification** to send an email to users when there is a password lock, unlock, or unlock attempt on their account.

9. Select **Allow Email OTP delivery** to allow OTP delivery to a user's email address. If this option is cleared, the user receives the OTP by SMS or voice.

10. Select **Do not use IP Address for Resource Rule Risk Factors** if you want to use IP address information for audit records, but not for resource rule risk conditions.

note
This setting appears only if you select **One Time Password** as a second-factor allowed for password reset.

11. Click **Save**.

12. Repeat these steps, as required, for other Named Passwords.

## Validate your changes

After you save, verify the following:

1. Users can access the forgot-password flow during authentication.
2. Allowed second-factor methods are offered in the configured order.
3. If additional second-factor is enabled, two second-factor challenges are required.
4. Notification and OTP delivery behavior matches the options you selected.