Password Reset and User Unlock Methods not clickable

SailPoint Human Fabric (SHF) SHF Discussion and Questions
,
1

Hello,

I have this problem.

In some identity profile the section “Password Reset and User Unlock Methods” is clickable/editable but in others no:

image
image713×489 28.6 KB

Why this happen ? What is the criteria to unlock for example “By providing a verification code sent to work email” ?

Thanks

2

Hi Francesco,

Did you configured security Questions? and Identities in Identity Profile have Alternate email and Phone?

Thanks,

Mahesh

3

Please validate once that there are mappings for the OOTB Work Email, Alternate Email, Work Phone, Alternate Phone identity attributes on the profile you’re trying to add unlock methods for

4

Hello Francesco. Mahesh and Margo’s suggestions are worth checking. Work Email (email) is a required identity attribute, and security questions are configured globally. So I would not assume missing mappings or user data alone explain the disabled options.

Since some profiles work, I would suggest comparing a working and affected profile:

  1. Settings: Sign-in Method, password reset settings, and authentication integrations.
  2. Mappings: Email and phone attributes.

SailPoint’s documentation does not clearly explain what disables these checkboxes.

Could you confirm whether both profiles use the same sign-in method and authentication setup? If everything matches, I would suggest raising a Support case.

5

On the Attribute Mapping of the identity profile I have set:

  • email (Work Email)
  • phone (Alternate Phone Number)
  • workPhone (Work Phone Number)
  • personalEmail (Alternate Email)

But nothing has changed.

6

Hi Francesco,

Thanks for confirming. Since all four attributes are mapped, I would focus on the authentication settings.

Could you compare a working and affected identity profile, particularly:

  1. Sign-In Method: SailPoint username and password vs. Directory Connection (pass-through authentication).
  2. Authentication integrations: any SSO or MFA differences.

SailPoint’s documentation does not clearly explain why these options become disabled. If both profiles have the same configuration, I would suggest opening a Support case.

7

Claude seems to agree with @punna0001

image
image722×757 58.6 KB

8

We opened a case to Sailpoint because we have 2 almost identical identity profiles but in one is possibile to manage the flags and in other is not possibile. But for now no response.

All is identical:

  • Invitation Options
  • Sign In Method
  • Block Access From
  • Password Reset and User Unlock Settings (also not manageble in some identity profiles)
  • Mapping email,phone,workPhone,personalEmail attributes
9

Check Below Steps

  1. Check whether identities associated with that Identity Profile have a valid work email populated/mapped.
  2. Check the Identity Profile’s Settings → Password Reset and User Unlock Settings.
  3. If enabling email/phone verification methods, ensure the corresponding email/phone information exists.
  4. If using MFA integrations such as Duo, RSA, or SafeNet, SailPoint states these require additional configuration before they become selectable in the Identity Profile.
  5. Also note that password reset isn’t available for disabled accounts until the account is re-enabled.