Minimum Version Required: 22.08
Steps
For Users with an email or mobile number (Recommended):
A) Have the user do their own reset:
Ask the user to navigate to the login page
Click 'Reset Password'
Enter their email or phone number (must match their user record)
Click the button to send the reset link
B) Send them an invite to reset their password
Using Universal Search, enter the User's name and select 'Search Users for [User's Name]'
Click on the 3-dot option next to the User record
Select 'Invite User'
Select the method to send the invite (email or text)
Select the checkbox for the user to send to
Click the 'Invite User' button at the top of the page
For Users without an email or mobile number (Not Recommended):
Using Universal Search, enter the User's name and select 'Search Users for [User's Name]'
Click on the 3-dot option next to the User record
Click 'Reset Password'
NOTE: if this option is disabled, it likely means the user has an email or mobile number, which prevents this option from being used
If the user has an email or mobile number, they must reset their own password, or use the 'Invite User' steps above
Enter the new password for the user
Re-enter the password to confirm
Click 'Set Password' to set their password to the new value
NOTE: The new password is a one-time-use password, the user will be asked to reset their password when they sign in the first time
-If users fail to enter a valid password after 6 attempts, they will be prompted with the message: You have exceeded the amounts of sign-in attempts. In this situation, the user must then reset their password to be allowed to log in again
Best Practices
General Best Practices
Give all users who need to sign into the system an email address (preferred) or a mobile number
Encourage users to reset their own passwords to limit administrative burdens
Note: Users are required to set their own password after signing in for the first time using a password set by an admin.
*Encompass specifically does not allow anyone other than the user themselves to know a permanent password.
This is a security best practice for several reasons:
Turnover Security: Having users be the only person to know their permanent password ensures that an Admin leaving the organization does not accidentally retain the login information for another employee.
Reduced Password Exposure: When administrators have the ability to set permanent passwords, those passwords are more likely to be exposed or written down somewhere, increasing the attack surface. Temporary passwords mitigate this risk.
Auditability and Accountability: Ensuring only the actual users have access to their password provides reliability in the audits and changes being made throughout the system, allowing you to know confidently that when an audit says that ____ user made a change, that user was the actual human making the change. Requiring password resets also means all password changes are logged and traceable back to the administrator who initiated them.
User Password Hygiene: Requiring users to set their own passwords encourages better password hygiene, such as using unique, complex passwords. This is better than admins setting weak, reused passwords.
Delegated User Control: Empowering users to manage their own passwords gives them a greater sense of ownership and control over their account security.
Reduced Admin Workload: While it may seem more convenient for admins to set permanent passwords, the tradeoffs in security and user experience outweigh this. Admins actually save time in the long run by not having to constantly reset forgotten or compromised passwords.
Compliance and Regulatory Requirements: Many compliance frameworks and regulations mandate that users have control over their own credentials. Restricting admin access to permanent passwords helps organizations meet these requirements.