Account claims and password resets: let people set their own password

An account claim lets someone claim their Owlie account for the first time, and a password reset lets them choose a new password, both without signing in. You start either one from their identity. They open a link Owlie emails them, or enter a six-digit code you read them, answer your organization's verification questions, and choose the password themselves. Administrators never see or type a person's password; an account claim or password reset is how you help someone who can't sign in, such as a new hire before their first day or someone locked out of their directory account.

A password reset you start is not the same as the Forgot? reset a person starts from the sign-in page. Yours asks your verification questions, can be given as a code by phone, and works when the person can't reach their sign-in email; a self-service reset goes to that email. Both set the person's password-linked accounts, such as their directory account, when the password link is on.

Account claims and password resets

Choice	What the person sets	Use it for
Claim their account	Their Owlie password, when your organization signs in with passwords, and every password-linked account. Their work email becomes their verified sign-in email.	A first sign-in, such as a new hire.
Reset their password, primary	Their Owlie password if they already have one, and every password-linked account.	A forgotten or locked directory password.
Reset their password, one account	That account only.	An account Owlie created that needs a password.

An account claim is for the first sign-in only. Owlie doesn't offer it to someone who has signed in before, or to someone without a work email from a connected directory: that address becomes their sign-in email. In an organization that signs in only through SSO, an account claim sets no Owlie password; it makes the work email the sign-in email, and sets any password-linked account.

A password reset never creates an Owlie password for someone who has none, and it grants nothing else. It sets the type of password your organization uses now: if you switched between Standard and Secure Login, a person who still has the old type gets the new type, which replaces it. What each one sets under each sign-in setup is in How each sign-in setup behaves.

Start an account claim or password reset

You need identity.modify and a recent second factor, or a recent sign-in if you have no authenticator app or passkey; Owlie asks you to confirm it's you when you start. An account claim also needs identity.login.manage, and giving a code by phone needs identity.claim.code (Give claim and reset codes by phone). The Owner and Admin roles have all three; the Operator role can reset passwords and give codes.

Open the person's identity and select Actions > Reset password or Actions > Start account claim. You can also select Start claim or reset under Account claims & resets in the Sign-in block of the Attributes tab.
Under What it's for, choose Claim their account or Reset their password. For a password reset with several options, choose Which password: Primary password or one account.
Under How it reaches them, choose one way in:
- Email the link to the person's personal email. The link works until the claim or reset closes: 7 days for an account claim and 72 hours for a password reset, by default.
- Give a code by phone. You read the person a six-digit code, and they type it with their work email on the claim or reset page. A code works for 30 minutes and stops after 5 wrong tries, by default.
Select Email the link or Give a code.

A choice Owlie can't offer for this person is turned off, with the reason beside it. The common ones:

The person has no personal email, or it is also an address they sign in with, so a link there would prove nothing more than access to that mailbox.
Your verification policy has no question, and you set codes to need one. See Verification questions.
A verification question can't be answered for this person, for example because their record has no value for it. Owlie names the question and starts nothing. Fix the record or the question first.

A code shows once. Read it to the person, and tell them which address to type it with: the dialog shows it, masked. Owlie stores only a fingerprint of the code, so if they don't get it, select Get a new code. If the link email couldn't be sent, the dialog says so and offers Give a code instead, which replaces the link.

Starting an account claim or password reset cancels the open one of the same kind, including a link already sent: when the person has one, the dialog says so before you start, and you can't start while it is being redeemed. A password reset also tells the person's verified sign-in email that a reset was started, where it went, and who started it. If Owlie can't queue that notice, it starts nothing and asks you to try again.

What the person does

They open the link, or select Have a claim or reset code? on the sign-in page and enter their work email and the code. Then they answer the verification questions, see what the password will be used for, and choose it against your password requirements. Owlie shows the result only when every account has taken the password. See Claim your account or reset your password for their side.

If an account refuses the password, the claim or reset stays open and the person can try a different one: 3 tries by default. Owlie doesn't count a try when the account was out of reach. When it wrote their Owlie password but a linked account failed, they can sign in, and that account shows Needs a password in My access.

Track and revoke account claims and password resets

Account claims & resets, in the Sign-in block of the identity's Attributes tab, lists the person's account claims and password resets, newest first. Each shows what it is for, how it went out, who started it, when it expires, the wrong codes, answers and password tries left, and the history of passwords tried, with Owlie's reason for each failure. An emailed link shows Sent, Sending… while Owlie is still trying to deliver it, or Not sent, in which case nobody has the link. The state is one of Open, Code expired, Locked (too many wrong answers), Redeeming, Completed, Revoked or Expired.

Revoke ends an open or locked account claim or password reset. A link already sent, or a code already given, stops working.
Give a code instead, on an emailed one, or Get a new code, on a code, cancels it and gives a new code for the same thing. For an account claim it needs the permission to manage the person's sign-in, as starting one does.

Neither is available while it is Redeeming: it ends on its own when every account has answered.

Verification questions

Your organization's account claim and password reset settings are under Admin > Tenant Settings > Authentication > Account claims & resets. Changing them needs settings.modify and a recent second factor (or a recent sign-in if you have none); anyone with settings.read can view them.

Verification questions. Up to three. Each has the text people see, an answer type (Text, Digits or Date) and an expected answer written as an OXL expression over the person's record, such as identity.employee_id. The editor's preview runs the expression against a made-up person, never a real record. Answers are compared ignoring case, accents, spaces and punctuation for text, and as dates for dates.
Require a verification question for codes given by phone. Off by default. Whoever gives a code sees it; without a question, they could set the person's password themselves. A question only stops them if they can't see its answer either.
Personal email. The identity attribute a link goes to. It can't be the sign-in email.

Questions check that a link or code reached the right person. They aren't a sign-in factor, and an answer that arrives in the same mailbox as the link, such as an employee ID in an offer letter, adds nothing. Owlie can't tell whether a personal email forwards to, or is another name for, the person's sign-in inbox: with no question, whoever reads that mailbox can set the person's passwords, directory ones included, with the link alone. Add a question if that matters to you. The strongest question is a code from HR given through another channel, such as an HR onboarding code in a printed offer pack.

Changing the questions or the personal email ends every open account claim and password reset, and Owlie warns you before it saves. People holding a link or code then need a new one.

Choose your settings

No questions (the default) suits an organization whose personal emails come from a trusted HR system: the link alone proves the person got the email. Anyone who reads that mailbox, or who gives a code, could set the password.
Add a question whose answer reaches the person outside that mailbox, such as an HR onboarding code in a printed offer pack, when a link might reach the wrong inbox or the personal email can be edited by people you don't fully trust. An employee ID or start date that also appears in an email to the same mailbox adds little.
Turn on Require a verification question for codes given by phone when the people who give codes shouldn't be able to set a person's password themselves. It only helps if they can't see the answer either. With it on, codes can't be given until the policy has a question.
Keep the Personal email attribute pointed at an address your HR or directory system fills, not one anyone can edit.
Shorten Code works for or the claim and reset lifetimes if links and codes sit unused; lower Wrong codes allowed and Wrong answers allowed if you see guessing.

Timings and limits

Each account claim or password reset keeps the values it started with. Changing these affects new ones only.

Setting	Default	Range
Code works for (minutes)	30	5–60
Wrong codes allowed	5	3–10
Wrong answers allowed	5	3–10
Passwords tried per claim or reset	3	1–5
Password resets last (hours)	72	1–168
Account claims last (days)	7	1–30

Start account claims and password resets automatically

A lifecycle reaction on an identity's Create or Modify, including one made from a date such as Start date, can run Start account claim or Send a password reset. What a reaction starts is always emailed, since there is no one to read a code to. A start that can't go ahead, such as a person with no personal email, is recorded on the identity. Only someone who could start an account claim or password reset themselves can add that action, or change what a reaction with one does or when it runs.

Account claims and password resets can't be sent by text message, and people can't start one themselves: the Forgot? link on the sign-in page is a separate, self-service reset.

When an account claim or password reset can't start

The start dialog turns off an option Owlie can't offer and says why. If you start one anyway, the dialog shows the reason. The common ones:

Owlie says	What to do
This person has signed in before, so an account claim isn't possible.	Start a password reset instead.
This identity has no work email from a connected directory.	Fix the work email in the directory and sync. A password reset by code can use the person's sign-in email instead.
This identity has no personal email to send the link to.	Set the person's personal email, or give a code.
The personal email is also a sign-in email for this person.	Give a code, or set a personal email they don't sign in with.
A verification question can't be answered for this person.	Fill in the value the question reads from their record, or change the question.
A claim or reset code needs at least one verification question.	Add a question, turn off the requirement, or email the link.
There's no password to set: this person has no Owlie password and no password-linked accounts.	Start an account claim if they have never signed in, or link a resource.
That account's password can't be reset right now.	Check that the account is provisioned and its resource has a Password step.
A claim or reset of this type is being redeemed right now.	Wait until it finishes.
Account claims and password resets are unavailable right now.	Try again later, or email the link instead of giving a code.
The person's sign-in email couldn't be told about this password reset, so it wasn't started.	Try again in a moment.

An emailed link marked Not sent reached nobody: use Give a code instead. When a reaction can't start one, the reaction's history shows why. Owlie doesn't retry a refusal, so start it by hand once the cause is fixed. For what the person sees when something goes wrong, see Claim your account or reset your password. When a linked account doesn't take the password, see When a password doesn't reach an account.

Limits

One open account claim and one open password reset per person. Starting another cancels the open one.
Links and codes go by email or by your phone call, never by text message.
Up to three verification questions.
The claim and reset page limits how often one network can try links, codes and answers, and a code stops working after its wrong-code limit.
An account claim is for a first sign-in only.