Set up password recovery for users

Before you begin: Users need a recovery phone number or email address where they can get recovery instructions:

• To have users set up recovery information, tell them to go to Set up a recovery phone number or email address.
  Important: Users who have 2-Step Verification enabled can use only a recovery email address to reset their password.
• To set up recovery information for users in the Admin console, go to Add recovery information for admins and users.

Users who haven't added recovery information are directed to contact an administrator.

1. Sign in with a super administrator account to the Google Admin console.

   If you aren’t using a super administrator account, you can’t complete these steps.

2.  In the Admin console, go to Menu  Security > Authentication > Account recovery.
3. (Optional) To apply the setting only to some users, at the side, select an organizational unit (often used for departments) or configuration group (advanced). Show me how

   Group settings override organizational units. Learn more

4. Click User account recovery.
5. Click Allow users and non-super admins to recover their account. This setting won't apply if your organization uses single sign-on (SSO) with a third-party identity provider or Password Sync.
6. Click Save. Or, you might click Override for an organizational unit.

   To later restore the inherited value, click Inherit (or Unset for a group).

Important: Immediately remove a user's recovery information either when they leave your organization or if their account might be hijacked (see below).

When non-admin password recovery is turned on, you should take precautionary action if you believe a user account may be vulnerable or compromised. For example:

• The user is terminated or leaves your organization.
• You suspect the account has been hijacked, and the user's recovery information has been changed.

In these cases, removing the user's recovery information is not enough to protect the account, since the information can still be used for recovery for a period of time after being removed. You should either change the user's password and disable non-admin password recovery, or suspend the user account to prevent all access.

• Google Workspace for Education users under the age of 18—With the Recovery information setting, you can allow users and admins to add a phone number and email address as recovery options. It’s automatically turned on for Google Workspace for Education super admins but is off for users. For users with primary or secondary education accounts, this option is not available. You or another super admin in your organization can turn the setting on for users with Higher Education accounts, other admins, and teachers.
• Organizations using SSO or Password Sync—If your organization uses single sign-on (SSO) with a third-party identity provider or Password Sync, the Allow users and non-super admins to recover their account setting won't apply.
  If your organization uses Password Sync and you prevented users from changing their Google passwords, users are redirected to Active Directory to reset their passwords. This keeps their Active Directory passwords in sync with Google Workspace.