How to Evaluate an MSP’s Password and MFA Reset Process

Treat account recovery as privileged work

Changing a password, replacing an authentication method, and restoring access to an administrator account are different actions. Ask which support roles can perform each one, what approvals they need, and which systems fall outside the service agreement. A reset procedure for ordinary employees should not silently become the procedure for every privileged account.

The CISA advisory linked below describes attackers persuading help desks to reset credentials and authentication methods. Use that documented threat as a reason to examine recovery controls, rather than as a claim that any particular provider has been compromised.

• Define the help desk service scope

Ask what establishes identity before a reset

Have the provider explain its approved verification methods without exposing sensitive implementation details in a sales presentation. A caller knowing an employee’s manager, job title, or email address should not be treated as sufficient proof. Neither should the request to call a new number supplied in the same unverified conversation.

Look for a documented process using previously established channels or another approved means of establishing identity. Ask what happens when those methods are unavailable. A manager can authorize work, but a manager’s approval and verification of the requester’s identity are separate questions. The exception path should identify who decides, what evidence is required, and how the decision is recorded.

Walk through a lost-phone scenario

Illustrative exercise: a remote employee calls shortly before a client presentation. They cannot use their usual authentication method and ask support to register a replacement phone. Have the proposed delivery team describe its actions in order, including the point at which it would stop and escalate. Do not use a real account or perform a live reset during the demonstration.

Then change one fact: the caller claims to be a senior executive, the request arrives after hours, or the normal approver is absent. The control should still have an accountable owner. A procedure that depends on one person being available needs a planned alternative.

• Record the demonstration in your provider scorecard

Protect the recovery path as well as the login

CISA recommends phishing-resistant MFA. Ask how the provider supports suitable methods across your applications and devices, and how enrollment, replacement, and recovery work. A stronger everyday sign-in method still needs a carefully controlled recovery route.

Ask the technical owner to distinguish routine lockouts from suspected compromise. An unexpected reset request or suspicious change may require security investigation rather than ordinary ticket closure. Agree who receives that escalation and which protective actions are authorized. Avoid treating a successful new login as proof that the underlying security concern is resolved.

Agree on service hours and useful reporting

Account recovery often becomes urgent outside normal office hours. Confirm whether the contracted service includes verification and execution then, or only intake. Define how support reaches an authorized backup approver and how employees receive updates while the request remains unresolved.

Review recovery tickets for repeated exceptions, failed verification attempts, and changes affecting privileged accounts. Keep passwords, recovery codes, and other secrets out of routine ticket notes. Ask what audit evidence the business can receive, how it is protected, and which role reviews unusual activity. A target for fast response should support a controlled process rather than reward bypassing it.

• Separate response targets from restoration commitments

Make the demonstration part of the buying decision

Ask each finalist to use the same fictional scenario and provide the same evidence. Record unresolved questions as conditions to close before onboarding. Once a provider is selected, give employees a business-approved support route and explain what legitimate support will ask them to do.

Revisit the workflow when authentication methods, support vendors, or approval roles change. The business should know how to recover access when an employee loses a device and how to challenge an unexpected recovery request. Those are practical outcomes to require alongside the help desk’s response-time figures.