Credential Governance
Forgot Password
People who forgot their password set a new one on the systems they pick, after proving who they are.
Completes when at least one system you picked accepts the new password.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Forgot Password from the AI Assistant You Already Use
Same verification workflow as the web app, run as a fresh challenge in the conversation. In Avabot and MCP the new password is generated for you and sent by email or SMS, never shown in chat. One completed reset = one Secure Outcome; failed attempts are never billed.
You: I forgot my password. Reset it. Avatier: verify: passed · systems: Active Directory, Entra ID · new password: generated, sent by email · reset: 2 of 2
Why it matters
A Forgotten Password Should Not Need a Phone Call.
Resetting a password by hand means a call, an identity check over the phone and a new password that passes through someone else's hands.
What a reset needs
Proof of identity with the methods your verification workflow allows, then a new password that passes every selected system's policy, including history and age rules.
What goes wrong by hand
A help desk reset depends on whoever answers checking identity the same way every time.
What Forgot Password does
The person verifies, picks the systems and sets the new password, against a live checklist of your Password Bouncer rules when those are on. Each system's reset is written to the activity log.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone forgets a password this month or not. Pay Per Identity Action™ charges only for completed resets.
The Action
How Forgot Password Runs
On the web, Forgot Password runs from the sign-in page or the signed-in tile. In Avabot and MCP you verify in chat and pick the systems, and Avabot sends you a generated password.
Start the Reset
Type your user name on the sign-in page, choose Forgot Password and pass the CAPTCHA check, or open the Forgot Password tile after sign-in. In Avabot, ask to reset your password.
Verify Your Identity
Answer the challenge your tenant's Password Management authentication workflow sets, with the methods your policy already allows, such as Security Questions, an SMS or email code, Google or Microsoft Authenticator, PingID Push or the Identity Challenge Card. Before sign-in this is always required; signed in, it is on by default (and always when your password has expired). Avabot and MCP always run their own challenge in chat, even after a recent connector sign-in.
Pick the Systems
Every eligible system is preselected. Systems an admin marks 'never set password' are not listed.
Set the New Password
Type and confirm the new password. When Avatier Password Bouncer policies are on, a live checklist shows each rule, with one password entry per distinct policy, and a password or passphrase generator appears when your tenant enables it. In Avabot and MCP you don't type one: Avabot sets a randomly generated password and sends it by email or SMS.
See the Results
The results page shows each system's outcome. The reset runs at once, with no approval and no justification. When your sign-in account is reset, your other Avatier app sessions end and the web app signs you out, unless your admin keeps the current session.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Forgot Password sets a generated password and sends it to the email address or mobile number on file, and refuses the reset when neither is on file.
Forgot Password needs you to be enrolled in Password Management already.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A reset completes when at least one system you picked accepts the new password. The results page shows each system's outcome. It runs at once and creates no request. One completed reset = one Secure Outcome.
Evidence
- An activity-log entry for each system reset (also sent to syslog or your SIEM)
- The Password Resets audit report
- The results page, with each system's outcome
- A results email, when your tenant's reset email template is on
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Reset
Pay per completed password reset. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Forgot Password, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed password resets only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | A new password is set on each system the person picks, after they verify, checked against your policies |
| Evidence | Silent failures and missing audit trails | An activity-log entry for each system and the Password Resets audit report |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems a Reset Touches
Forgot Password sets the new password in Active Directory, Entra ID, LDAP directories and connected apps whose connector can set passwords, checked first against Avatier Password Bouncer policies when Password Bouncer is enabled.
- LDAP
- Microsoft
- Active Directory and Entra ID accounts, through their connectors.
- Connected Apps
- Apps whose connector can set passwords. Systems an admin marks 'never set password' are hidden.
- Password Bouncer
- When enabled, every new password is checked against its policies first.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Is my new password the same on every system?
One password goes to every selected system that shares a password policy. When policies differ, the screen asks for one password per policy.
Can Avabot let me choose my new password?
No. Avabot generates a password, applies it, and sends it to your email or mobile on file. It is never shown in chat.
Will a reset sign me out?
Yes. Your other Avatier app sessions end, and the web app asks you to sign in again with the new password unless your admin keeps the current session.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Forgot Password
You've Automated the System. Now Secure the Credentials.
People who forgot their password verify, pick their systems and set a new one, with each reset in the activity log.