SOLUTION DATASHEET

Self-service password reset with OneLogin
RELIEVE THE HELPDESK, SECURE YOUR BUSINESS, AND EMPOWER EMPLOYEESManual password resets: Unnecessary work, cost, and risk
Today’s business environment just keeps growing in complexity. In fact, 94 percent of Chief Information Oﬃcers believe thetech stack will be more complex in the future, with more apps, data, devices, and transactions. And 93 percent of CIOs
anticipate the pace of business will increase, with 59 percent predicting it will more than double by 2025.1
More applications, more users, and more types of users (full-time employees, contractors, partners, even customers), means
more password reset requests. If yours is like most IT departments, the requests are probably already piling up creating an
endless barrage of helpdesk tickets, introducing security risks, and negatively impacting employee productivity—and thereputation of the IT team.

Challenge: Endless helpdesk tickets●Per Gartner, up to 50 percent of helpdesk inquiries
are password reset requests.

●Forrester Research found the average helpdesk
labor cost for a single password reset is $70.2●

Forrester found some large US-basedorganizations must allocate over $1 million annuallyfor password-related support costs.3

Challenge: Risky password practices●●Helpdesks typically use predictable schemes for
temporary password (i.e., “MonthYear”). These
weak passwords often go unchanged by users.
Cybercriminals spoof password reset requests tocompromise accounts.

Challenge: Productivity impacts●

When users are locked out of systems, they aren’tproductive. But they are frustrated.

●Second and third shift employees, night owls, andweekend warriors face extreme wait times.

●Work slows down, and when it’s customer-facing,you risk reputational and relationship damage. Oreven violating Service Level Agreements (SLAs).

Solution: Self-service password reset with OneLogin
OneLogin enables employees to reset their own
passwords while enforcing secure password practices.
OneLogin:●Eliminates up to 50 percent of helpdesk requests,
cutting considerable cost and saving staﬀ time.

●Enforces strong password and access policies.

●Ensures simple and secure access from any
location and device for every employee.

Simple and secure access with Single Sign-On
With the OneLogin Single Sign-On (SSO) portal, users only
have to enter one set of credentials to access their apps inthe cloud and behind the ﬁrewall via desktops,
smartphones, and tablets. That means greater productivity
and security.
OneLogin’s policy-driven password security andmulti-factor authentication (MFA) ensure that onlyauthorized users gain access to sensitive data.
Implement more secure password policies including
required length, complexity, and password-reuse
restrictions. Add session timeouts and self-service
password reset to heighten protection without impedingusers.

1 “The Future of Identity and Access Management: A CIO Survey”, Pulse Q&A, January 2019
2,3 “Best Practices: Selecting, Deploying, and Managing Enterprise Password Managers”, Merritt Maxim and Andras Cser, Forrester Research, January 8, 2018

“We have implemented the password reset feature, reducing
calls to our support team by approximately 45% - a percentage
we expect to continue to rise.”- Ben Mollett, Application Delivery Engineer, Acuris“We’ve seen a substantial reduction in the number of password
reset requests ﬂowing through the help desk. When you’reaccessing through OneLogin, you never have to do anythingwith your password - it’s a huge time saver.”- Brim Bason, IT Solutions Architect, Susan G. Komen

The OneLogin Uniﬁed Access Management Platform

Self-service password reset: How it works
OneLogin is a frictionless way to synchronize password
changes across Active Directory (AD), the OneLogin portal,
and the web apps secured with OneLogin.
●●●When a user’s password expires in AD, they’reprompted to change the password the next timethey log into OneLogin.
Users can proactively change their AD password
through OneLogin in the OneLogin Portal.
When a user changes their password via
OneLogin, it keeps the password synchronizedwith AD and any cloud applications wherepassword provisioning is active.

By default, the OneLogin AD Connector only requires readaccess to a corporate domain for authenticating users andgathering user attributes for provisioning. But you canexplicitly grant it permission to allow the changing andsynchronization of user passwords.

INFO@ONELOGIN.COM | 855.426.7227 | ONELOGIN.COM

When a user’s password expires in Active Directory, thereal-time connection to OneLogin reﬂects this immediatelyand will prompt the user to change their password fromthe OneLogin sign-in page.
The user is presented with an easy to follow workﬂow andprompted to input their current password and newpassword twice (similar to what a user experiences on
their desktop when changing their domain credentials).
Once the new password is conﬁrmed, OneLogin changes
the user’s password in Active Directory to match, and alsoprovisions it out to any applications that are conﬁgured
with password provisioning in OneLogin.
Additionally, if a user decides they would like to change
their password prior to the password ever expiring, they
may sign into OneLogin and change their password atanytime from their OneLogin portal, with fullsynchronization.