Prepare for a lost device with approved backup authentication, a known recovery route, clear business coverage, and checks after access is restored. Use a practical recovery plan.
On this page
A manager loses the phone they use to sign in to several business services. Their laptop still has an open session, but the recovery information is stored on the missing device. The team needs to protect access while keeping today's customer commitments moving.
An account recovery plan prepares for that situation before it becomes urgent. It identifies the services involved, the authentication and recovery methods each actually supports, the people who can coordinate a response, and the work another authorized colleague can cover. Each person should recover their own account through the controlling service's process.
Review an app connection against its purpose, permissions, data direction, mapping, owner, and observed result. Distinguish saved configuration from verified data movement.
·6 min read
Security & Trust
List the services needed for everyday operations, including email or identity providers that other accounts depend on. Record the responsible person, business purpose, official sign-in destination, and where the current recovery instructions can be found.
Map dependencies. A business application may rely on an external identity provider. An email account might receive recovery notifications for several services. If all recovery routes depend on one unavailable device or account, the team should recognize that dependency before a loss.
Keep this inventory restricted and concise. It should describe responsibilities and approved storage locations without containing passwords, recovery codes, private keys, or detailed personal identifiers. A planning record is a reference to protected material, not another copy of it.
Choose an owner to review the plan when people, devices, or sign-in methods change. Record the last review and any unresolved dependency that needs attention.
Prepare authentication and recovery separately
Check the options offered by each service. A supported additional authenticator may let a person sign in when their usual device is unavailable. A recovery process addresses a different situation and may require further checks or waiting.
NIST's digital identity guidance recommends that providers encourage users to maintain at least two separate ways to authenticate, reducing the need for recovery. It also distinguishes account recovery from ordinary authentication. Use the service's actual supported options when making the plan.
Scrollable article table
Preparation
Question to answer
Normal sign-in
Which supported method does this person normally use?
Additional authentication
Can they use an approved method without the missing device?
Recovery route
What official process applies if normal sign-in is unavailable?
Protected storage
Where is permitted recovery material stored securely?
Dependencies
Does the route require another account or device?
Where a service issues recovery material, protect it according to its instructions and the organization's security rules. Keep it available to the legitimate account holder when the primary device is unavailable. Do not put secrets in shared meeting notes or send them to colleagues as a shortcut.
Arrange business coverage through existing permissions
Identify essential work that another authorized colleague can perform while the account holder recovers access. The replacement should use their own account and the access assigned to their role. A shared password undermines that separation.
Confirm whether critical administrative work depends on only one person. Use the organization's approved access process to establish appropriate coverage in advance, with a defined role and review owner. Avoid giving broad permissions simply because they might be convenient during an emergency.
Keep account recovery separate from workspace access decisions. Restoring a person's login does not itself confirm that their role or access to every business resource is appropriate. Likewise, another administrator's access does not give them permission to impersonate the affected person.
The Workspace Access Review Checklist helps review continuing member and role access. This plan addresses loss of an authentication route and temporary business continuity.
Respond to a lost device through the approved process
Report the loss promptly to the responsible security or service owner using a known contact route. Record when the device was last available, which business accounts might be affected, and whether any sessions remain accessible on other devices.
Use a known, trusted device and the service's official destination when taking recovery or protective action. Avoid following unsolicited messages offering to restore access or asking for codes. A colleague coordinating the incident should not request the account holder's authentication secrets.
Follow the controlling service's process to address the affected authenticator and sessions. If session revocation or device management is supported, confirm what the action actually changes and record the result. Device removal in one service does not establish that every other session has ended.
Keep recovery, containment, and business coverage visible as separate work. The account holder can regain access while an affected device or unfamiliar activity still requires investigation under the organization's incident process.
Use the recovery route without weakening verification
If approved alternative authentication is unavailable, use the service's established recovery process. Gather only the information it requires through its official channel. A business deadline does not justify bypassing identity checks or asking a colleague to approve an unfamiliar request without verification.
Record the request reference and current state, including any waiting period or action required from the account holder. Keep sensitive evidence in the protected process that owns it. The shared coordination note should contain the next action and owner rather than private recovery evidence.
If the normal route depends on another inaccessible account, resolve that dependency through the appropriate provider or organizational support process. Repeated guessing or opening inconsistent requests can make coordination harder.
Tell the business coverage owner what remains blocked. They can use permitted access to handle the agreed work while the recovery request proceeds, without promising an unconfirmed restoration time.
Verify access and complete the follow-up
After access is restored, verify the account identity and the necessary business access. Review the supported authentication methods, recovery destinations, sessions, and relevant activity with the responsible owner. Investigate unfamiliar changes through the applicable security process.
Replace or remove affected authentication material as the controlling service requires. If recovery material was used or exposed, follow the service's rules for replacement. Check the resulting configuration so the next recovery path is based on what is actually in place.
Scrollable article table
Follow-up check
Recorded result
Account access
Legitimate account holder can use the approved sign-in route
Affected methods
Protective action taken in each controlling service
Recovery preparation
Supported backup and recovery routes are current
Business work
Temporary owner hands back current commitments
Open security issues
Responsible owner, next action, and review point
Figena's Trust Center describes workspace, role, and authorization boundaries. Keep recovery of a personal sign-in and authorization to workspace work distinct, including when an external identity provider controls authentication.
Rehearse a hypothetical loss without disabling access
Consider a hypothetical five-person consultancy whose manager uses a phone for an authentication method. During a planned review, the manager checks whether they could use the service's approved alternative from another trusted device. The team reviews its instructions without deliberately removing the working method.
The review finds that the manager's recovery reference depends on the same phone. The manager corrects the storage arrangement through the approved process. A second authorized colleague confirms they can cover customer scheduling under their own account if the manager is temporarily unavailable.
The team records the essential services, approved routes, dependencies, response contact, temporary coverage, and follow-up checks. It repeats the review after a significant device or sign-in change. This hypothetical exercise tests readiness while preserving the access people need to work today.
Check the purpose, content, version, recipient, and delivery method before sharing a business record. Use a practical checklist for internal and external handoffs.
Review workspace members, roles, shared resources, and external services against the work people do today. Use this checklist to record decisions, preserve business continuity, and verify changes in the system that controls access.
