Admins can reset any user's password without knowing the current one. This is separate from the user-initiated password reset flow (which requires email access) and is always available regardless of the Enable Password Resets Site Setting.
Admin-initiated password resets are essential for:
- Users who've forgotten their password and either can't access their email or don't want to wait for a reset link.
- Users whose email has been compromised — admins can reset the password and re-secure the account.
- Account recovery after a long absence (annual leave, sabbatical, etc.) where the user can't remember what they used.
- Bulk operations on accounts that need to be reset for policy reasons.
How to do it
From the All Users list, click into the user. Their profile opens. There's a Reset Password button in the profile actions. Click it and you get two choices:
Option 1: Set a new password manually
You type a new password directly. The user can then log in with that password and (typically) change it themselves after first login.
Pros: instant — no waiting for emails to arrive. Cons: you know their password, which is a security concern; you have to communicate it to them somehow.
Option 2: Send the user a password-reset email
The platform generates a one-time reset link with a time-limited token and emails it to the user. They click through and pick their own password.
Pros: you never know their password; reset is self-service from there. Cons: relies on email delivery; user has to wait.
Audit trail
Every admin-initiated password reset is recorded in the audit log — who reset, whose password, when, and which option was used. Useful for compliance and for incident review ("who reset the CFO's password last Tuesday?").
The audit entry is visible from the user's profile under the History tab. It's also surfaced in the platform's main audit log for cross-user investigation.
Force change on next login
Optionally mark the new password as temporary. The platform then forces the user to pick a new password the first time they log in. This is the recommended pattern for admin-set passwords because:
- You don't end up with the admin and the user both knowing the password long-term.
- The user is more likely to pick something they'll remember if they choose it themselves.
- It's a clear signal to the user that the credentials they have are temporary.
Three real-world reset scenarios
Scenario 1: User locked out and can't access email
Admin resets the password manually, communicates the new password via phone, marks it as one-time. User logs in, sets their own password, continues.
Scenario 2: User's email was compromised (they tell you they think someone has access)
Admin resets the password manually (so the attacker can't intercept a reset email), invalidates all active sessions for the user, requires 2FA setup on next login.
Scenario 3: Annual security review found weak passwords
Admin runs a bulk reset Task that sets every affected user's password to one-time-temporary and emails them the reset link. Users pick new (stronger) passwords on next login.
Warning: Be very careful about who has admin reset privileges. The combination "can reset anyone's password" + "can log in as that user afterwards" is effectively account takeover. Keep the count of users with reset permissions small, audit it quarterly, and force 2FA on admin accounts.