Mizo Named Runner-Up in ConnectWise IT Nation PitchIT Competition 2025 Read the full press release
Mizo logo - AI agent service desk automation platform for MSPs and managed service providers

Mizo

Mizo logo - AI agent service desk automation platform for MSPs and managed service providers

Mizo

Sign In Book a demo

Require End-User Verification on Password Reset Tickets

Ask AI about this doc

Pick an assistant and ask your question — we'll send it along with a link to this article.

Before a Microsoft 365 password is reset, Mizo verifies that the requester is who they say they are by sending a challenge to a device or address already on record. This guide sets up the pieces involved: the Microsoft 365 connection, the resolution scenario, and the verification settings.

Before you start

  • The client’s Microsoft 365 tenant is connected — see the Microsoft 365 GDAP Setup Guide. Automatic resolution needs the client’s verified domains and a separately granted write permission; read-only access isn’t enough.
  • The requester exists as a contact in your PSA, so Mizo can resolve them against the record on file.
  • You have full access to the Workflow, Fine-tuning and Integrations pages.

Steps

  1. Turn on diagnosis. On the Workflow page, turn on the Diagnostic Agent. Matching password-reset and lockout tickets now get a read-only Resolution Plan, including an identity check of the requester.
  2. Turn on execution for password resets. Turn on the Resolution Agent, then select the M365 password reset scenario under Fine tuning → Resolution. A scenario left unselected can be diagnosed but never applied.
  3. Configure verification methods. In the end-user verification settings, choose which methods are used and in what order — a Microsoft Entra MFA push, with a secure one-time link as the fallback when the push isn’t available or accepted. Clients standardized on Duo can be verified with a Duo push.
  4. Choose which companies are covered. Include or exclude specific companies so verification runs only where you need it — for example, roll it out to a few clients first.
  5. Brief your technicians. On a matching ticket, the technician checks the verification status in the Mizo pod, uses Retry Verification if the requester missed the push, and only then clicks Apply resolution plan.

What technicians see

  • Verification statuses such as Not Started, Pending, End User Denied and End User Failed, with the next step highlighted.
  • A notification history showing every verification request sent and its status.
  • If the identity check fails outright, no plan is created and the panel shows “Plan could not be created” with the reason. A request from someone other than the account owner carries a visible security warning.

The verification method, outcome and timestamp are written to the ticket as structured fields, so you can show afterwards exactly how a request was verified.

Good to know

  • A locked-out user can almost always still verify: they’ve lost their password, not the phone their authenticator is enrolled on.
  • Challenges only ever go to a device or address registered before the request — never to a number given during the call or in the ticket.
  • Mizo never uses security questions.

INFO

The Diagnostic Agent and Resolution Agent switches apply to the whole account, not per client. A client without a Microsoft 365 connection never produces a resolution plan, so only connect Microsoft 365 for the clients where you want password resets to run.