> For the complete documentation index, see [llms.txt](https://docs.siit.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.siit.io/guides/integrations/integrations-iam/get-locked-out-users-back-into-their-account-and-device.md). # Recover a locked-out user Send locked-out employees a temporary password, access code or recovery key privately via JumpCloud, Google, Entra ID, Okta, Jamf, Iru or Intune actions, logged on the request When an employee is locked out, you want them back in quickly, without pasting a password into a chat thread. Siit's recovery actions hand the employee a password, a code or a key through a private channel, and log every use on the request. ### Which action for which problem * **Forgotten password:** generate a temporary password in JumpCloud, Google Workspace or Microsoft Entra ID. * **Lost second factor:** create a temporary access code in Okta, a Temporary Access Pass in Microsoft Entra ID, or issue one backup verification code in Google Workspace. * **Locked out of the computer:** send the recovery key (JumpCloud, Jamf, Iru, Intune) or the Recovery Lock password of an Apple silicon Mac (Jamf, Iru). ### Run an action from a request 1. Open the request and find the integration block in the side panel. 2. Run the action. For a temporary password, choose whether Siit generates it or you type one. 3. For a device secret, a short dialog asks what to do with it. Leave **Send it to the requester privately** on, or turn it off to see the secret once yourself. Copy it before you close the dialog, because Siit does not show it again. You can also run these actions from the person's or the computer's page. ### How the employee receives it * **Slack:** a direct message from the Siit app, with a **Reveal** button. * **Microsoft Teams:** a personal chat, with a **Reveal** button. * **Portal or admin console:** a reply on the request that only the requester can open. Nobody else sees the value. The request shows a **Secret code issued** event with the recipient and the expiry, never the value itself. ### How long it lasts A password or code expires after 60 minutes by default. When it expires, Siit deletes the message that carried it. Okta sets its own expiry on temporary access codes, and that one applies. Recovery keys behave differently. Siit fetches the key your device management tool already holds, so it stays valid until your IT team rotates it on the computer. ### In workflows and with the AI agent * A workflow step that issues a code sends it by itself. Don't add a message action after it. * These steps work on Request and App access workflows, where there is a requester to send to. People workflows don't offer a generated code. * Recovery key and Recovery Lock password steps can target the device selected on the request, or the requester's own devices. The device must be held by the requester, otherwise the step fails. See [Run device actions from a workflow](/guides/workflows/run-device-actions-from-a-workflow.md). * The AI agent can run these actions, but it never sees the value. * Intune's recovery key is only available from pages you open yourself, not in workflows or for the AI agent. ### Before you start * Connect the provider in **Settings → Workspace → Integration library**. * For the Entra Temporary Access Pass, an admin must reconnect the **Microsoft Entra Actions** integration once to grant the extra permission it needs. * A recovery key is only offered for a computer that has the key escrowed, that Siit holds for that employee, and whose owner in your device management tool matches their account. * Your role needs access to the integration. See Control who can use external actions. ### Frequently asked questions #### Can I read the password or code again? Not once it has been revealed or has expired. Run the action again for a new password or code. For a recovery key, running it again fetches the same key. #### What if Siit can't send it to the employee? When you run the action from a request, Siit shows you the code once instead and records that you revealed it. #### What happens if the delivery fails in a workflow? The step shows an error. For a JumpCloud temporary password, the old password has already been replaced, so run the step again to generate and deliver a new one. #### Why does Google only give one backup code? Siit only ever hands out a single code, never a full set. It is the way back in after a lost second factor, including when your organization enforces 2-step verification and Google doesn't let you turn it off for one user. Once the employee is back in, you can invalidate their other backup codes. #### Why can't I see the recovery key action on a computer? The computer must have a key escrowed in your device management tool and be assigned to that employee. If it was reassigned recently, the owner no longer matches. ### Need help? Contact . --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.siit.io/guides/integrations/integrations-iam/get-locked-out-users-back-into-their-account-and-device.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.