Expected behavior for password reset

[alexgrutza]

Is this expected behavior for a user to experience when resetting their password?

We have an OU for users who authenticate and use MFA via Google (alumni primarily). This OU allows users to recover their accounts and reset their passwords via Google.

We have our active users (staff/students/faculty) access Google via our SSO platform.

A user in this "alumni" OU, is not able to reset their password. Here's what happens as I just tested:

1. Go to gmail.com
2. Click Forgot password
3. Enter the users org email
4. Google asks for first and last name, I enter it
5. It then says it will send a verification code to the users email (ie. the org email)

The issue is, the user doesn't have access to it because they don't have the password, and the user can't reset the password because it sends a verification code to the same email they're trying to log into..

MFA is enforced for this "alumni" OU, but this person is in a temporary MFA bypass group so that they can log in and set up MFA.. Issue is as stated, they can't get in because they can't reset their password because Google sends a verification code to their Org email, which they don't have access to, which they can't... 

Is this expected behavior?

[Kim_Nilsson]

The recovery method should be either another email address or a phone number.

IIRC, you should be able to both see and edit both.

We don't allow password recovery, but, then again, we also don't have/allow alumni accounts.

[alexgrutza]

So the user does not have a recovery email set up in their account. They do have a number but am unsure if they received an SMS about resetting their password. I was able to manually (from Admin) reset and send them the reset password email. 

Just found it weird that Google would send the reset email to their Org email (I understand, where else would they send the email if no recovery was on file) if the user initiated it on the login page themselves. 

[YERKO]

Según entiendo y asumo:

Al momento de crear cuentas para usuarios de forma masiva, cuando no se llenan todos los campos importantes los espacios quedan sin información. Quizas eso ocurrió con el usuario en cuestión y probablemente con varios más, de ahí la importancia de educar a los usuarios de nuestras cuentas educativas, junto con señalar o entregar su cuenta de usuario y contraseña (de preferencia temporal y cambiable la primera vez que inicia seción), enseñarles que deben completar su información personal agregando un correo particular (para recuperación de contraseñas) y su numero celular.

Saludos

[Kim_Nilsson]

I am of the complete opposite opinion. Especially for education users, they should never fill in personal or private information in their accounts. Password recovery should be disabled, and require communication with the nearest admin, who can help with password reset.