mfa-reset

Reset Microsoft Entra ID MFA methods after identity verification.

Updated Aug 27, 2026
One-click install
npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill mfa-reset
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: mfa-reset
Source: https://github.com/afoxnyc3/chelsea-piers-itops/tree/main/chelsea-piers-itops/skills/mfa-reset
Command: npx skills add https://github.com/afoxnyc3/chelsea-piers-itops --skill mfa-reset

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps recover access when Microsoft Entra ID MFA is failing or the user has lost or changed their authenticator method, by guiding a controlled MFA reset and re-enrollment process.

Core Features & Use Cases

  • Identity-verified MFA reset flow: Enforces mandatory identity verification before any MFA changes, with additional approval requirements for admin accounts.
  • MFA method guidance and removal planning: Determines the MFA reason (new phone, lost device, number change, unknown), reviews current methods, and provides removal/re-enrollment instructions.
  • Connector-aware execution: If identity connectors are available, supports method-removal actions; otherwise provides a safe manual portal flow and documents the outcome.

Use case example: A user reports they lost their phone and can’t receive MFA codes; the helpdesk agent verifies identity, removes stale MFA methods, and directs the user through Microsoft Authenticator re-registration to restore access.

Quick Start

Ask to reset MFA for a specific user by providing their username or UPN and the reason, for example: run the mfa-reset skill with [email protected] new-phone.

Frequently Asked Questions about mfa-reset

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reset Microsoft Entra ID MFA methods for a user who lost their phone?

You can reset Microsoft Entra ID MFA methods by enforcing mandatory identity verification, determining the reason like a lost phone, removing the stale methods, and directing the user to re-register in Microsoft Authenticator.

What is the helpdesk workflow for Entra ID access recovery when MFA fails?

The helpdesk workflow for Entra ID access recovery involves verifying the user's identity, determining the MFA failure reason, removing the failing authentication methods via connectors or the manual portal, and providing Microsoft Authenticator re-enrollment guidance.

Do I need SysAdmin approval to reset MFA for admin accounts with elevated roles?

Yes, SysAdmin approval is required for MFA resets on admin accounts with elevated roles, establishing a strict escalation path from the standard L1 Helpdesk non-admin account workflow.

Can I remove Entra ID authentication methods automatically without identity write access?

Connector-based Entra ID authentication method removal requires available identity write access; without it, the workflow provides safe manual portal steps to remove the MFA methods and document the outcome.

What are the limitations of using a helpdesk workflow for MFA access recovery?

Limitations include restricting L1 Helpdesk workflows to non-admin accounts, enforcing mandatory identity verification before any changes, and requiring an escalation path with SysAdmin approval for accounts with elevated roles.