Playbook, SaaS company
Reset my password is often the wrong question on a team account
Sign in on a business product is not one mechanism. Some members hold a password, some arrive through their employer's own sign in, and where that is enforced for a workspace the reset screen is deliberately switched off. The assistant cannot send a link and cannot see which mechanism anybody is on, so the useful reply explains how a person works out which of the two they are.
Why this is not the general answer
The handling pattern for password resets holds across every trade. What follows is the part that does not.
- Where single sign on is enforced for a workspace there is no password to reset, and the reset page is disabled on purpose, so the first move is establishing whether this member even has one.
- The reset email goes to a work address, and the commonest reason it never arrives is a corporate mail filter or a mailbox that was closed when somebody changed role, neither of which is anything you can fix from your side.
- People hold accounts in several workspaces on the same product, so a reset can succeed against the one they were not trying to reach, which produces a working link and a sign in that still fails.
- When the company sign in is itself the thing that has broken, the fix is inside the customer's own systems, and saying so early is the difference between an afternoon and a week.
How it arrives
- i never got the password reset email
- we use single sign on but it is asking me for a password
- the reset link expired before i clicked it
- can an admin reset my password for me
- i can get in on my phone but not on my laptop
- our sso stopped working this morning
What has to be indexed for this to work
| Which sign in methods you support, and how a member tells which one applies | The observable difference, written down: what the sign in screen looks like when a workspace is federated, what it looks like when it is not, and what a member sees if they belong to both kinds. Without this the assistant cannot even ask the right first question. |
|---|---|
| The reset link lifetime and what invalidates it | How long a link lives, whether requesting a second one kills the first, and whether the link is single use. Expired link questions are almost entirely produced by somebody clicking the older of two emails. |
| Delivery notes for the reset message | The address it is sent from, the domain an administrator would need to allow, and the fact that a quarantined message never bounces. This turns a dead end into a specific instruction for the customer's own mail administrator. |
| What an administrator can do that a member cannot | Force a reset, change the address on a member record, or temporarily lift enforced sign in. Name the role, because the answer for a stuck member is frequently to ask a colleague rather than to ask you. |
The reply
If your workspace uses your company sign in, there is no password on our side to reset and the reset page is switched off, which is why it may look broken [1]. You can tell from the sign in screen: the wording and the button differ between the two, and the comparison is on that page. If you do use a password, the reset link expires after the period set out there and requesting a new one cancels the earlier email, so use the most recent [2]. I cannot send a reset link or check whether one was delivered, so if neither of those fits, leave your name and the email you sign in with and the team will look.
It puts the federated case first, because that is the version where every other instruction is wasted effort. The observable test matters more than the explanation, since the person is looking at the screen while they read. And the two email problem is named directly, as it accounts for most of what gets reported as an expired link.
Where it stops
The trigger. The visitor asks for a link to be sent or resent, says company sign in is failing for more than one person, or cannot say which sign in method their workspace uses.
I cannot send a reset link or see whether one arrived. Leave your name and the email you sign in with, and say whether your company uses its own sign in, and the team will take it from there.
It stops answering before it guesses, says who will pick it up, and asks for the one thing that makes a reply possible. Nothing about it reads as a dead end.
Never say this here
Out of bounds
- Never say a reset email has been sent, resent or delivered, because nothing here triggers one.
- Never confirm whether a given email address has an account, since that answers a question worth asking for the wrong reasons.
- Never advise turning off enforced single sign on to get somebody in, as that is a security decision belonging to the customer's own administrators.
- Never suggest creating a second account to get past a sign in problem, because it splits the person's work across two members and a seat.
Questions
- Could it trigger the reset if we connected it to our product?
- No. It reads material you give it and writes into nothing, so a reset always happens on your own screen. What it removes is the message that was only ever asking why the link expired or where the email went.
- Should it ask which sign in method somebody uses?
- One question, framed as something they can see on the screen in front of them, is worth it, because the two answers have nothing in common. More than one question and you have built an interrogation in front of somebody who is already locked out.
- People ask it to confirm which email their account is under. Can it?
- No, and it should refuse plainly rather than apologetically. It cannot look anybody up, and confirming that an address does or does not have an account would be a useful answer to give to the wrong person.
Keep reading
- Everything for a SaaS companyOne widget serves prospects, trialists and paying customers. What it can answer about plans and limits, and what has to reach a person.
- Handling password resets in generalAn assistant cannot reset anything. It can walk somebody through your real flow and name the step that usually breaks.
- Nobody still at the company can administer the accountOrphaned admin rights, expired invites and the wrong workspace. Access questions on a team product, and where the assistant has to stop.
- Three different people send this message and only one of them owns the dataDeactivating a member is not deleting them. Backups, subprocessors and who is asking decide the answer, and none of it happens in chat.
- The one question where the correct reply is somewhere elseAn assistant reads documents, not systems, so it cannot know the service is degraded. Point at the status page and say nothing about now.
Try it on your own material
Upload a document or point it at your site, paste one line of HTML, then ask it something only your business could answer.