We're a company with around 300 employees spread across the US, Germany, and Southeast Asia, and I've noticed a growing issue with our helpdesk tickets related to employees changing their SIM cards when relocating abroad. Whenever a team member moves or takes on a long-term assignment overseas, they often get a local SIM without informing IT. As a result, their Okta SMS factor stops working without a heads-up, or worse, HR notifies no one in IT. By the time an employee realizes they're locked out of their accounts, it's typically several days into their trip, leaving their old number inactive or reassigned to someone new back home.
The situation is even trickier with Entra, where if a user enrolled their phone MFA and needs a reset, only a handful of authorized admins can clear this manually. If it's a Friday and the employee is across several time zones, it can lead to considerable delays.
Last year, we encouraged everyone to enroll in the Okta Verify app to reduce reliance on SMS, which helped somewhat. However, some users who got new phones and restored from backups found their Okta Verify enrollment didn't transfer over. Currently, when these issues arise, the user emails helpdesk, it escalates to tier 2, they reset the factor, and then the user re-enrolls. We're looking at an average resolution time of around 6 hours, often longer due to time zones. Has anyone successfully tackled self-service recovery without creating a social engineering risk?
5 Answers
Identity verification for helpdesk calls is crucial. Make sure there's a structured way to confirm the identity of the person reaching out to avoid any complications.
This is more about improving processes rather than just relying on technology. Streamlining the communication between HR and IT would be beneficial.
You might want to consider making this more of an HR issue than an IT one. The onboarding process for international moves could benefit from clearer guidelines to ensure that IT is looped in whenever someone relocates.
Absolutely! This is definitely a policy or communication gap rather than purely a tech issue.
Absolutely, you need to decide if you want to risk identity security or just hope employees will manage their phone changes responsibly. Maybe making re-enrollment a standard part of the HR transfer process could work.
Improving the HR process when employees move to different countries can really help. Do you have any protocols in place for updating contact details?
Exactly! That needs to be prioritized since it affects the self-service recovery process.