IT playbook · AI Employee: Ivy

Okta Password / MFA Reset

Reset completed under 60s; audit_event written

Install this playbookBack to marketplace
The problem

Password reset is the single most common IT support ticket at every company. Every time it takes 30-60 minutes to route to a human, the requester is locked out of their job, the IT team loses time on a solved problem, and the org accumulates learned helplessness about how long simple things take. It should be seconds.

At a glance
Trigger
Chat (Slack/Teams/Portal)
Approvals
Step-up MFA on the requester
What it does
Writes to your systems
Systems
Okta · Identity verification
How it feels in production

An hour-by-hour walkthrough.

9:03am Wednesday. Priya can't log in. She DMs Ivy in Slack: "I can't reset my Okta password, it says my MFA isn't working." Ivy verifies Priya's identity via a step-up challenge to her registered device (or a live video verification if the device is what's broken), pulls up her Okta record, clears her MFA factors, sends a self-service password reset link to her recovery email, and posts the confirmation in the same thread. 9:04am. Priya gets the reset link, sets a new password, re-enrols her authenticator. She's back in. Every step of that flow lands in the audit log — who requested, when, who / what verified, what factors were cleared, what link was sent. Security gets a summary in their weekly digest of all password / MFA resets. Anomaly signals (multiple resets in a week, resets from unusual IP) escalate to a human immediately. If Priya's identity can't be verified via device or manager, the request escalates. The Assistant never resets a password on a request it can't attribute to the real employee.
How it works

Step by step.

  1. 01

    Identify requester

    Read the requester's identity from Slack / Teams SSO. Pull their Okta record — is the account active? Is it locked? Are there recent failed attempts?

    Slack · Teams · Okta
  2. 02

    Verify identity via step-up MFA

    Send a push challenge to the requester's registered device (or SMS to their registered phone). If the requester's registered device IS what's broken, escalate to manager-verification or live-video fallback per policy.

    Okta · Twilio · Duo
  3. 03

    Reset password or clear MFA factors

    On verified identity, clear the specific MFA factor that's failing (or all factors if the requester needs a full reset). Send a self-service reset link to the recovery email or Slack DM.

    Okta
  4. 04

    Force re-enrolment on next login

    Enrolment flags flipped on the account so first successful login prompts MFA setup fresh. Old factors invalidated.

    Okta
  5. 05

    Notify + audit

    Reset confirmation posted in the requester's Slack / Teams thread. Full event written to audit_events with actor, target, IP, device fingerprint of the verifier.

    Slack · Audit log
Systems and wiring

What you connect to make this run.

Okta

read+write

Service account with password-reset + factor-management scopes. Never uses admin-level 'set password' — always sends the user self-service link so nobody, including us, sees the plaintext.

Slack · Teams

trigger

Chat DM to Ivy triggers the flow. Requester identity read from Slack/Teams SSO. Never accepts requests via email or unauthenticated portal.

Twilio · Duo (fallback identity verification)

write

When the registered device IS what's broken, SMS or voice-call fallback to registered phone. Zero-fallback policy for high-privilege accounts — human verification required.

What changes

Before and after, honestly.

Time from request to reset
Before
30-60 minutes across ticket routing
After
Under 90 seconds in-chat
IT time per reset
Before
~10 minutes across ticket handling + verification + reset action
After
0 minutes for verified requests; escalations only
Password reset ticket volume
Before
~20% of all IT tickets
After
Near zero — resolved in-chat before a ticket exists
Fraudulent reset attempts caught
Before
Detected only in post-hoc audit
After
Anomaly signals surface within 1 hour
Related

Playbooks that pair with this one.

IT

Identity Group Management

The natural next request after 'reset my password' is often 'add me to this group'.

Security

Compromised Credential Response

When the reset request is triggered by a real credential leak, this playbook fires alongside.

Security

Anomalous Login

Anomaly signals from suspicious resets feed this security playbook.

HR

Employee Offboarding

Password reset requests on terminated identities should fail cleanly — this playbook ensures the offboarding pipeline is intact.

Frequently asked

Answers about this playbook.

How is this different from Okta's self-service reset?

Okta's self-service reset works when the user still has access to their MFA device. When they don't — which is the common failure mode — they hit an IT ticket. Ivy handles that recovery flow with identity verification, factor clearing, and audit — all in Slack, without a ticket.

What if the requester can't pass the identity verification?

Escalation to a human IT operator with the request context bundled. Ivy never resets a password on a request that failed identity verification. Manual paths (live video, manager verification) are documented in the runbook and available to the operator.

Can this handle SSO providers other than Okta?

Yes — same pattern for Microsoft Entra ID, Google Workspace, WorkOS, Auth0, JumpCloud, OneLogin. Each provider's API differs; the playbook shape is identical.

What about phishing risk — could an attacker trick Ivy into a reset?

Identity verification runs against a registered device or channel, not a claim made in-chat. Ivy never accepts 'this is Priya' as verification — always requires a factor the real Priya controls. Anomaly signals (unusual IP, multiple resets, resets right after suspicious login) escalate immediately.

Does this cover high-privilege accounts?

By default, high-privilege accounts (admin, IT, security) require human verification — the playbook escalates rather than auto-resets. Configurable per role in the Approval Policy.

See it run on your data.

Free plan, no credit card. Connect the systems this playbook needs and run it against a past event first.

Book a demoMore IT playbooks