End User Verification Setup Guide
Purpose
This document walks through setting up the End-User Verification Agent, which confirms that the person behind a request is who they claim to be before Mizo acts on a sensitive request, such as a Microsoft 365 password reset.
Verification relies on your clients’ Microsoft 365 tenants, which Mizo reaches through GDAP (Granular Delegated Admin Privileges) from your Microsoft partner account. The end user confirms their identity with a Microsoft Authenticator push or by signing in to their Microsoft 365 account — the same identity they already use every day.
Before you start
- Your PSA (ConnectWise PSA, Autotask or HaloPSA) is connected to Mizo.
- You have active GDAP relationships in Microsoft Partner Center with the clients you want to cover.
- You can sign in as a Global Administrator of your partner Microsoft tenant.
- The requesters exist as contacts in your PSA, with the same email address as their Microsoft 365 account.
Section 1 – Add End User Verification to your plan
End User Verification is an additional package that can be added to your plan.
- Log into the Mizo console.
- In the left-hand menu, under Additional agents, click Request access and mention End User Verification to add it to your plan.
- Once it’s part of your plan, an End user verification tab appears in Workflow.
Section 2 – Connect Microsoft 365 (GDAP)
Full details, prerequisites and troubleshooting are in the Microsoft 365 GDAP Setup Guide. In short:
Step 1: Sign in with your partner admin account
- In the Mizo console, go to Integrations > Microsoft 365 (GDAP).
- Click Sign in with Microsoft and sign in as a Global Administrator of your partner tenant.
Step 2: Select the client tenants
- Mizo lists the client tenants you have an active GDAP relationship with.
- Select the tenants where you want End User Verification, then click Save and connect.
- Wait until each tenant shows Healthy.
Step 3: Match Microsoft tenants to PSA companies
- Link each Microsoft tenant to its company in your PSA. Mizo suggests matches based on the company name — review them before saving.
- Click Save.
CAUTION
A client whose Microsoft tenant isn’t linked to a PSA company can’t be verified with the Microsoft 365 methods. Check the matching step for every client you want covered.
Section 3 – Check your PSA
End User Verification itself has no PSA-side prerequisites: it reads the requester from the contact on the ticket.
Your PSA only matters if you let the agent write to tickets (Section 4, Step 3):
| If you enable… | What’s needed |
|---|---|
| Create internal note | On HaloPSA, the Mizo note action must exist — see Section 2, Step 5 of the HaloPSA guide. Accounts connected before this step was added to the guide should check it; without it, notes fail. Nothing extra for ConnectWise PSA or Autotask. |
| Change ticket status | The status you want to use while verification is pending (for example Waiting on Customer) exists in your PSA. |
Section 4 – Configure End User Verification in Mizo
In the Mizo console, go to Workflow and open the End user verification tab. Changes are saved with the Save bar at the bottom of the page.
Step 1: Confirm Microsoft 365 is ready
At the top of the tab, you should see Microsoft 365 ready. If it shows Microsoft 365 not set up, no client tenant is reachable yet: go back to Section 2 and make sure at least one tenant is Healthy and linked to a company.
Step 2: Choose and order the verification methods
The agent tries the enabled methods from top to bottom and stops at the first one that succeeds. Drag the methods to reorder them.
| Method | How the end user verifies | Notes |
|---|---|---|
| MFA push notification | Approves a request in their Microsoft Authenticator app. | Recommended first. Fastest for the user, and works even when they forgot their password, since they still have their phone. |
| Email with Microsoft sign-in | Clicks an emailed link and signs in to their Microsoft 365 account. | Good fallback when the user doesn’t answer the push or has no Authenticator app. |
| Email with confirmation link | Clicks a single-use emailed link. | Doesn’t need a Microsoft 365 account, but is only as safe as the user’s mailbox. Keep it last. |
Keep at least one method on. The two Microsoft 365 methods only work for clients connected in Section 2.
Step 3: Set the permissions
| Permission | Options | What it does |
|---|---|---|
| Run end user verification | Off / HITL / Autonomous | HITL (human in the loop): a technician starts the verification from the Mizo pod. Autonomous: the agent sends the verification on its own. Off disables End User Verification entirely. |
| Change ticket status | Off / Autonomous | Moves the ticket to a waiting status while verification is pending, and back once it resolves. |
| Create internal note | Off / Autonomous | Records the verification outcome as an internal note on the ticket. |
We recommend starting with Run end user verification set to HITL, so your technicians see each verification before it’s sent. Move to Autonomous once you’re comfortable with when it triggers.
Step 4: Write your custom instructions
Under Custom instructions, describe your rules in plain language. Each box applies only while its permission above is on.
- When to trigger — which requests require verification, and which never do. Example: “Always verify before a password or MFA reset. Never verify for printer issues.”
- Ticket status change — which status to use while verification is pending, and what to do when it fails. Example: “Move the ticket to Waiting on Customer while verification is pending.”
- Note creation — what the internal note should contain. Example: “Always record which method verified the end user and when it completed.”
Step 5: Choose which companies are covered (optional)
Open Advanced configuration:
- Enable for selected companies only — verification runs only for these companies. Leave empty to cover every active company. Useful to pilot with a few clients first.
- Disable for selected companies — verification never runs for these companies.
Only one of the two lists can be used at a time.
Step 6: Turn on password reset resolution
Verification runs on the tickets the Resolution Agent picks up. To have Mizo prepare Microsoft 365 password resets that are gated on verification, follow Require end-user verification on password reset tickets.
Section 5 – Test the complete setup
Step 1: Create a test ticket
- Pick a test user in a client tenant connected in Section 2, who exists as a contact in your PSA and has Microsoft Authenticator set up.
- Create a ticket for that contact asking for a password reset (for example “I forgot my password and can’t log in”).
Step 2: Run the verification
- Open the ticket and the Mizo pod. A Verify end user step appears with the status Not started.
- With HITL, click Open, then Send MFA push. With Autonomous, the push is sent automatically.
- The status moves to Pending while the user is asked to approve the request on their phone.
Step 3: Confirm the result
| What the end user does | What you see |
|---|---|
| Approves the push | Verified — the resolution plan can be applied. |
| Declines the push | End User Denied — don’t apply the change without another form of verification. |
| Doesn’t answer, or has no Authenticator | Delayed — a Fallback sign-in link is ready. Share it through a channel the user can access (PSA portal, SMS, chat or in person), not only the affected mailbox. |
If you enabled the permissions in Section 4, Step 3, also check the internal note and the ticket status in your PSA.
INFO
A technician can always use Mark verified manually after verifying someone another way (for example, in person). It’s recorded as a manual verification on the ticket.
Troubleshooting
- The End user verification tab isn’t visible in Workflow: End User Verification isn’t part of your plan yet. Add it from Additional agents, or contact your Mizo contact.
- The tab shows “Microsoft 365 not set up”: No client tenant is reachable. In Integrations > Microsoft 365 (GDAP), check that at least one tenant is Healthy and linked to a PSA company. See the Microsoft 365 GDAP Setup Guide troubleshooting tables.
- No verification appears on a password reset ticket: Check that Run end user verification isn’t Off, that the ticket’s company isn’t excluded under Advanced configuration, that the request matches your When to trigger instructions, and that the Resolution Agent is set up for password resets.
- “Could not start end user verification”: The resolution plan has no target Microsoft 365 user. Check that the ticket contact’s email matches their Microsoft 365 account and that the company is linked to the right Microsoft tenant.
- The push is unavailable for a user: The user has no Microsoft Authenticator push set up. Use the Fallback sign-in link, or move Email with Microsoft sign-in higher in the methods list.
- Notes aren’t written to the ticket: Check that Create internal note is Autonomous. On HaloPSA, check that the Mizo note action exists.
For anything else, contact [email protected].