--- title: Get locked-out users back into their account and device description: Set a temporary password, issue a temporary access code or share a recovery key for JumpCloud, Google, Entra, Jamf and Intune. --- [Skip to content](https://help.siit.io/get-locked-out-users-back-into-their-account-and-device#main-content) [![Logo\_Siit\_Full\_White](https://help.siit.io/hs-fs/hubfs/Logo_Siit_Full_White.png?width=70&height=33&name=Logo_Siit_Full_White.png)](https://help.siit.io/?hsLang=en) - [Help Center](https://help.siit.io/) - [Docs](https://docs.siit.io/) - [API reference](https://developer.siit.io/api-reference/authentication) - [Changelog](https://www.siit.io/changelog) Open main navigation Close main navigation - [Help Center](https://help.siit.io/) - [Docs](https://docs.siit.io/) - [API reference](https://developer.siit.io/api-reference/authentication) - [Changelog](https://www.siit.io/changelog) How can we help? - There are no suggestions because the search field is empty. 1. [Help center](https://help.siit.io/?hsLang=en) 2. [Integrations](https://help.siit.io/integrations?hsLang=en) 3. [Identity Provider](https://help.siit.io/integrations?hsLang=en#identity-provider) # Get locked-out users back into their account and device When an employee is locked out, you want them back in quickly, without pasting a password into a chat thread. Siit's recovery actions hand the employee a password, a code or a key through a private channel, and log every use on the request. ### Which action for which problem - **Forgotten password:** generate a temporary password in JumpCloud, Google Workspace or Microsoft Entra ID. - **Lost second factor:** create a temporary access code in Okta, a Temporary Access Pass in Microsoft Entra ID, or issue one backup verification code in Google Workspace. - **Locked out of the computer:** send the recovery key (JumpCloud, Jamf, Iru, Intune) or the Recovery Lock password of an Apple silicon Mac (Jamf, Iru). ### Run an action from a request 1. Open the request and find the integration block in the side panel. 2. Run the action. For a temporary password, choose whether Siit generates it or you type one. 3. For a device secret, a short dialog asks what to do with it. Leave **Send it to the requester privately** on, or turn it off to see the secret once yourself. Copy it before you close the dialog, because Siit does not show it again. You can also run these actions from the person's or the computer's page. ### How the employee receives it - **Slack:** a direct message from the Siit app, with a **Reveal** button. - **Microsoft Teams:** a personal chat, with a **Reveal** button. - **Portal or admin console:** a reply on the request that only the requester can open. Nobody else sees the value. The request shows a **Secret code issued** event with the recipient and the expiry, never the value itself. ### How long it lasts A password or code expires after 60 minutes by default. When it expires, Siit deletes the message that carried it. Okta sets its own expiry on temporary access codes, and that one applies. Recovery keys behave differently. Siit fetches the key your device management tool already holds, so it stays valid until your IT team rotates it on the computer. ### In workflows and with the AI agent - A workflow step that issues a code sends it by itself. Don't add a message action after it. - These steps work on Request and App access workflows, where there is a requester to send to. People workflows don't offer a generated code. - The AI agent can run these actions, but it never sees the value. - Intune's recovery key is only available from pages you open yourself, not in workflows or for the AI agent. ### Before you start - Connect the provider in **Settings → Workspace → Integration library**. - For the Entra Temporary Access Pass, an admin must reconnect the Microsoft Entra ID integration once to grant the extra permission it needs. - A recovery key is only offered for a computer that has the key escrowed, that Siit holds for that employee, and whose owner in your device management tool matches their account. - Your role needs access to the integration. See [Control who can use external actions](https://help.siit.io/control-who-can-use-external-actions?hsLang=en). ### Frequently asked questions #### Can I read the password or code again? Not once it has been revealed or has expired. Run the action again for a new password or code. For a recovery key, running it again fetches the same key. #### What if Siit can't send it to the employee? When you run the action from a request, Siit shows you the code once instead and records that you revealed it. #### What happens if the delivery fails in a workflow? The step shows an error. For a JumpCloud temporary password, the old password has already been replaced, so run the step again to generate and deliver a new one. #### Why does Google only give one backup code? Siit only ever hands out a single code, never a full set. It is the way back in after a lost second factor, including when your organization enforces 2-step verification and Google doesn't let you turn it off for one user. Once the employee is back in, you can invalidate their other backup codes. #### Why can't I see the recovery key action on a computer? The computer must have a key escrowed in your device management tool and be assigned to that employee. If it was reassigned recently, the owner no longer matches. ### Need help? Contact [support@siit.io](mailto:support@siit.io). - [Getting started](https://help.siit.io/getting-started?hsLang=en#main-content) - [For Admins](https://help.siit.io/getting-started?hsLang=en#for-admins) - [Employee Guides](https://help.siit.io/getting-started?hsLang=en#employee-guides) - [Request and Service Management](https://help.siit.io/request-and-service-management?hsLang=en#main-content) - [Request](https://help.siit.io/request-and-service-management?hsLang=en#request) - [Email](https://help.siit.io/request-and-service-management?hsLang=en#email) - [Service catalog](https://help.siit.io/request-and-service-management?hsLang=en#service-catalog) - [SLAs](https://help.siit.io/request-and-service-management?hsLang=en#slas) - [App access](https://help.siit.io/request-and-service-management?hsLang=en#app-access) - [AI & Agents](https://help.siit.io/ai-agents?hsLang=en#main-content) - [Overview](https://help.siit.io/ai-agents?hsLang=en#overview) - [Setup](https://help.siit.io/ai-agents?hsLang=en#setup) - [Use cases](https://help.siit.io/ai-agents?hsLang=en#use-cases) - [Automations and Workflows](https://help.siit.io/automations-and-workflows?hsLang=en#main-content) - [Getting started](https://help.siit.io/automations-and-workflows?hsLang=en#getting-started) - [Use cases](https://help.siit.io/automations-and-workflows?hsLang=en#use-cases) - [Integrations](https://help.siit.io/automations-and-workflows?hsLang=en#integrations) - [Reporting and Analytics](https://help.siit.io/reporting-and-analytics?hsLang=en) - [Integrations](https://help.siit.io/integrations?hsLang=en#main-content) - [Communication](https://help.siit.io/integrations?hsLang=en#communication) - [HRIS](https://help.siit.io/integrations?hsLang=en#hris) - [Ticketing](https://help.siit.io/integrations?hsLang=en#ticketing) - [Knowledge base](https://help.siit.io/integrations?hsLang=en#knowledge-base) - [Identity Provider](https://help.siit.io/integrations?hsLang=en#identity-provider) - [Device Management](https://help.siit.io/integrations?hsLang=en#device-management) - [Knowledge Base Management](https://help.siit.io/knowledge-base-management?hsLang=en) - [Admin, Security & Workspace](https://help.siit.io/admin-security-workspace?hsLang=en#main-content) - [Workspace Settings](https://help.siit.io/admin-security-workspace?hsLang=en#workspace-settings) - [SSO (SAML)](https://help.siit.io/admin-security-workspace?hsLang=en#sso-saml) - [SCIM & Provisioning](https://help.siit.io/admin-security-workspace?hsLang=en#scim-provisioning) - [People & Directory](https://help.siit.io/admin-security-workspace?hsLang=en#people-directory) [![Siit\_Logo\_Dark](https://help.siit.io/hs-fs/hubfs/Siit_Logo_Dark.png?width=140&height=67&name=Siit_Logo_Dark.png "Siit_Logo_Dark")](http://siit.io) Copyright © 2025, Siit SAS