Account security for managed users

Because your organization controls the accounts of its managed users, it can step in when something goes wrong with them: a lost phone, a stolen laptop, a suspected breach. This page describes those tools.

Note: these actions are available only for managed users, the ones whose e-mail is on one of your verified domains. A guest’s account belongs to the guest. If a guest’s account may be compromised, deactivate the user and ask them to secure their account.

Before you start

You need the Owner, Administrator or Helpdesk role. See Administrative roles.

Remove a user’s MFA

When a person loses access to their authenticator app, for example after changing phones, they can’t complete multi-factor authentication (MFA) anymore. Removing it lets them sign in with their password and set MFA up again.

Open the user. On the Overview tab, the MFA field shows Enabled or Not configured.
Select the trash icon next to Enabled (Remove configured MFA).
Confirm in the Remove two-factor authentication dialog with Remove.

The person can set up MFA again at any time. If your organization requires MFA, they are asked to configure it at their next sign-in.

Important: until the person sets MFA up again, their password alone is enough to sign in. Before removing it, make sure you are really talking to the person, for example with a video call or through their manager.

End a user’s sessions

Each time a person signs in to BreezeAuth on a device, a session starts. The Active sessions tab of a managed user lists them:

Column	What it shows
Device	The browser and system used to sign in.
Location	The approximate location, based on the IP address.
IP address	The last IP address the session was used from.
Last activity	When the session was last used.
Started at	When the person signed in.

To end one session, for example on a lost or shared device, select End active session on its row and confirm with End session. To end them all, select End all sessions and confirm with End sessions. The person is signed out of BreezeAuth on those devices immediately and must sign in again.

Note: ending BreezeAuth sessions doesn’t sign the person out of applications they have already opened. Each application keeps its own session, until it expires there. To stop access to an application right away, also end the session in the application itself, if it allows it.

Respond to a security incident

If you suspect that passwords or devices across your organization were compromised, you can sign out every managed user, force everyone to change their password, or lock access to all applications at once. See Incident response.

Changes are audited

Removing MFA, ending sessions and forcing password changes are recorded in your organization’s Audit Logs, together with who did it and when.