Account recovery policy
Turn off self-service password recovery for the whole organisation, or lengthen how long a reset link stays valid, from 60 minutes up to 208 days.
Console: Identity → Account Recovery, at /iam/account-recovery. This is an admin-facing policy document — one per organisation — for the mailed password-reset link every tenant already had. Before this screen existed, that link was a single hard-coded path for every organisation: always available, always valid for exactly one hour, with no way to turn it off or change its window. This screen is that document.
What it actually controls
Two real settings, both genuinely read by the forgotten-password endpoint on every request:
| Setting | Effect |
|---|---|
| Allow email recovery | When off, POST /auth/unlock's sibling forgot-password endpoint mints no reset token for anyone in this organisation and sends no mail — the request is silently absorbed. Turning this off is a real, working way to force every password reset in your organisation through an administrator instead of self-service. |
| Link valid for (minutes) | The lifetime of a freshly minted reset token, from 60 minutes up to 208 days (60 x 24 x 208 minutes). The default organisations start with is the historical one-hour window; this screen is what lets you lengthen or shorten it. |
The response to a forgotten-password request is HTTP 202 either way — whether the address exists, whether it belongs to this organisation, and whether recovery is turned on or off. This is the same enumeration-oracle reasoning Self-service account unlock documents for its own request endpoint: an endpoint that answers differently depending on internal state is a way to learn things about an organisation's configuration or its people from the outside. Turning email recovery off does not make the endpoint start refusing requests visibly — it makes it accept them and quietly do nothing.
SMS and voice: recorded, and honestly inert
What this screen does not touch
- Account lockout from repeated failed sign-ins is a separate mechanism entirely — see Password policy and lockout for the fixed five-attempts/fifteen-minute lockout, and Self-service account unlock for the self-service unlock link that clears it without touching a password at all.
- Recovery codes for a lost authenticator are untouched by this screen; see Recovery codes for where those do and do not work today.
- A password's actual complexity requirements are not this screen's concern — see Password policy and lockout and, for the newer group-scoped rules, Ranked password policies per group.
Endpoints and permission
GET .../recovery-policy organizations:read
PUT .../recovery-policy organizations:writeGated on the organizations permission family — the same one the org-wide password policy and legacy sign-on-policy documents use, rather than a recovery-specific permission. Disabling email recovery or lengthening a reset token's validity window is treated as exactly as sensitive as either of those.
An organisation that has never opened this screen reads as DefaultRecoveryPolicy: email recovery on, one-hour tokens — the same behaviour every tenant had before this policy document existed. Saving the screen for the first time creates the row; there is no separate "activate" step.
What to do with this
- Leave email recovery on unless you have a specific reason and a working administrator-reset process to fall back on — most organisations should not touch this screen at all.
- If your organisation has a security policy that mandates a short recovery-link lifetime, tighten it here; the floor is 60 minutes, which matches what every tenant already had by default.
- Do not tell an auditor or a colleague that SMS or voice recovery is available to your users because this screen shows the switch turned on — it is not, until the product actually builds the challenge flow behind it.