Guides
Password resets and account recovery: the quiet cost of business email lockout
Business email lockout costs more than the inbox: who may reset, what proof to demand, and how to keep an account recovery audit trail that holds up.
What to take away
- A locked mailbox blocks more than email. It blocks every service that uses that address as the login.
- Recovery should need a second factor or a named approver, never a security question alone.
- Every reset deserves a timestamp, an approver name, and a written reason.
- Verified staff should be back in their mailbox inside 30 minutes.
- Choose a provider on its admin recovery tools first, then compare the rest of the feature list.
Why a locked mailbox stalls everything
When a mailbox locks, the person loses mail, calendar invites, file shares, and every password reset link that arrives in that inbox. Most services treat the business address as the identity, so one mailbox failure reaches many systems. The practical detail is set out in Which email client software for business.
One email account lockout becomes a queue of failed resets at other vendors, plus a support call for each. The recovery path around the mailbox decides how much of the day is lost.
Who is allowed to reset a password
Small firms often give every administrator full reset rights. That is convenient until a departing employee uses them. A written password reset policy settles the question before the pressure arrives.
Three password reset tiers
Self service
- Who approves
- User
- Proof required
- Second factor
- Backup named
- N/A
Delegated admin
- Who approves
- Named IT contact
- Proof required
- Verified callback
- Backup named
- Required
Provider support
- Who approves
- Vendor
- Proof required
- Published identity check
- Backup named
- Required
Split rights into three tiers:
Who is allowed to reset
- Self servicethe user proves identity with a second factor and resets alone.
- Delegated admina named IT contact resets after a verified callback.
- Provider supportthe vendor resets after an identity check that follows published rules.
Access control guidance such as the NIST Cybersecurity Framework treats authentication and account recovery as one process rather than two. Name a backup for every approver so a holiday does not become a blocker.
What proof should be required before a reset
A security question is not proof. Public records, social profiles, and old breach lists answer most of them. Require a stronger check:
Proof before any reset
- Confirm via channel user already owns
- Read last login and last reset
- Get written manager approval for shared inbox
- Issue one-hour temporary credential
- Force change at first sign in
What proof should be required
- Confirm the request through a channel the user already owns, such as a video call or a phone number on file.
- Read the last login and last reset in the account recovery audit trail before touching the account.
- Get written approval from a manager or mailbox owner when the request covers a shared inbox or a finance role.
- Issue a temporary credential that expires within one hour and force a change at first sign in.
Shared vaults and emergency access are the features worth comparing in password managers, because the recovery credential is often the weakest item in the stack.
Comparing the four recovery paths
Who approves
- Self service reset
- Account owner
- Delegated admin reset
- IT admin and manager
- Vendor support ticket
- Provider support
- Security questions
- Nobody
Proof required
- Self service reset
- Authenticator app or hardware key
- Delegated admin reset
- Callback to a number already on file
- Vendor support ticket
- Account details and identity documents
- Security questions
- Answers chosen years ago
Where it fails
- Self service reset
- The user lost the device
- Delegated admin reset
- The approver is offline
- Vendor support ticket
- Queue time and a shared inbox
- Security questions
- Answers are often public
The last row is the one to remove from any business email account recovery plan. Because the mailbox acts as the master key to almost every other account, score providers on admin recovery tools before the demo and work through a business email software comparison first.
Keeping an account recovery audit trail
Record the request time, the requester, the proof checked, the approver, the credential issued, and the moment access ended. An audit trail lists who changed what and when, which is the standard used in security and document work.
Review the log monthly and flag resets outside business hours, repeated resets on one address, and approvals granted by the person who requested the change. Those three patterns hold most of the risk. Keep the records for at least a year, and longer where a client contract or a regulator asks for it.
A readiness checklist for admins
A reset that only one person can approve is a single point of failure. Four habits keep the path short and the evidence complete.
- Keep a verified phone number and a named manager for every mailbox.
- Publish the exception path for nights, weekends, and travel.
- Test one real recovery each quarter and time it.
- Review the reset log at the monthly admin meeting.
