Reset or switch off MFA for one user

5 min read Updated 4 November 2026

"Reset MFA" usually means one of three different things. Picking the right one matters, so start here before you touch anything.

(a) New phone, same requirement — the person still needs MFA, they just need to enrol again (new phone, reinstalled app, lost access to the old one or their passkey). You remove their authenticator app and any passkeys so they set it up fresh at next sign-in. One user: Security tab → Reset authenticator. Several: Password actions → Reset 2FA secret.
(b) Turn the requirement off for this user — the school doesn't require MFA (or you're correcting a mistake) and you want this person's own MFA flag switched off, in bulk. This is the Password actions → Disable 2FA item — see Bulk actions on users. It does nothing for someone your school's staff or student setting covers: the school setting still applies at sign-in and they're asked again. For them, use (c).
(c) The school requires MFA, but excuse this one person — the school-wide setting stays on for their group, but this individual is excused from it. This is the exemption, not a reset. One user: Security tab → Exempt from MFA. Several: Password actions → Exempt from MFA.

If you're not sure which applies: (a) is for someone who is locked out of their old authenticator but should keep using MFA; (c) is for someone who genuinely can't use MFA at all (no personal device, a disability an authenticator app doesn't accommodate, a shared/break-glass account).

Admins and owners always use 2FA, so (b) and (c) don't apply to them: their Require 2FA switch is locked on, they can't be exempted, and the bulk actions skip them and say how many. Only (a) works for an admin. See Require MFA for staff and students.

What the exemption actually does

The member is not prompted for MFA at sign-in, even though the school-wide setting for their group (staff or students) is on.
The Settings sweep that turns a school-wide MFA setting on and pushes it to existing members skips exempt rows.
The nightly sync respects it too — an exempt member is never swept back into "must use MFA" by reconciliation, only by an admin explicitly removing the exemption.
It's recorded in the admin audit trail, both when it's set and when it's removed.
It's reversible: removing the exemption re-applies the school's requirement for that person immediately, the same way turning the school-wide setting on does for everyone else.

Reset one user's authenticator (new phone)

Step 1 — Open the user's edit page

In the left sidebar, under Users & Groups, open Users and select Users again, find the person, and select their name. The edit page opens inside one school, so switch to the person's school first if you're in MAT overview.

Step 2 — Reset their authenticator

Open the Security tab. In the Two-factor authentication card, select Reset authenticator and confirm the prompt (Reset this user's 2FA?). The button is greyed out when they haven't set up an authenticator app or a passkey yet, because there is nothing to reset.

Their authenticator app and any passkeys are removed. They'll be walked through setting 2FA up again the next time they sign in — this doesn't change whether MFA is required for them, only that they need to re-enrol.

Exempt or un-exempt one user

Step 3 — Open the Security tab

In the same Two-factor authentication card, the button reads Exempt from MFA if the person isn't currently exempt, or Remove MFA exemption if they are. It only appears while the school requires MFA for their role (or while they are exempt), because an exemption means nothing otherwise.

Step 4 — Confirm

Select the button and confirm. The change applies immediately.

Doing this for several users at once

Select the users in the Users list, then open the action bar's Password actions menu:

Reset 2FA secret — removes the authenticator app and any passkeys for everyone selected; they each re-enrol at next sign-in.
Disable 2FA (or Enable 2FA) — sets the per-user MFA flag off (or on) for everyone selected.
Exempt from MFA / Remove MFA exemption — applies or removes the exemption for everyone selected.

Reset 2FA secret, Exempt from MFA and Remove MFA exemption ask you to confirm first, naming how many accounts are affected. Enable 2FA and Disable 2FA run straight away, so check your selection first. Admins and owners are skipped by Enable 2FA, Disable 2FA and Exempt from MFA, and the message says how many (for example, 1 admin was skipped: admins always use 2FA.). See Bulk actions on users for the full action bar.

Finding people with the 2FA filter

The Users list has a 2FA filter (under Security) to find people in a particular state before you act on them:

Setup — their own 2FA switch is on and they've set up an authenticator app or a passkey.
Enabled — their own 2FA switch is on.
Disabled — their own 2FA switch is off. People who are exempt show here too.
Exempt — MFA is switched off for this person specifically, regardless of the school-wide setting for their group.

The filter reads each person's own switch. Admins and owners always use 2FA whatever their switch says, so for the real picture across everyone — admins included — use School settings → 2FA set-up.

Combine the filter with select all matching, then apply a Password action from the bar — for example, filter to Exempt to review who currently has an exemption, or to Enabled to find people who still need to enrol.

From the assistant

Once your organisation switches on assistant actions (they're off unless Realsmart has turned them on for you), you can ask for the single-user actions above in plain English from search or the assistant. Nothing runs straight away: every action shows a confirm card naming who it affects first — see Ask the assistant to do things, which lists what is switched on today. After an exemption or its removal you're offered Undo, and you can run up to 10 assistant actions an hour.

Reset one user's authenticator — say "reset 2fa for…", "reset mfa for…", or "reset authenticator for…" followed by the person's name or username.
Exempt someone from MFA — say "exempt from mfa for…", "disable mfa for…", or "turn off mfa for…" followed by their name or username.
Remove an exemption — say "enable mfa for…" or "remove mfa exemption for…" followed by their name or username.

Until then, use the buttons named above. They are the same change either way.

Was this guide helpful?

We read every response — it decides what we rewrite next.