Agent WranglersSecond factors and recovery Required
Plan for losing every factor
Write down one recovery path for people who lost every factor and every recovery code. Make it slower and louder than sign-in.
How to do it
Try the paths in order, starting with a recovery code, then another bound factor, then a support process. NIST SP 800-63B-4 section 4.2.1 lists four kinds, namely saved codes, issued codes, recovery contacts and repeated identity proofing. For business users, an organisation admin's approval is a good proof. Wait at least 72 hours before access returns. Email every verified address at the start, with a link that cancels the recovery. When it completes, remove every old factor and session, then ask for a new factor. Support cannot skip the wait, as check who is asking says.
How to check
Run the process on a test account with no factors. Access returns only after the wait. Every verified address got a notice, and its cancel link stops the recovery.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/recovery-without-factors.