Unlock Messages for End Users

Use these workflows to help end users access password reset messages and other identity-protected content. Start with the quickest method for the situation, then use the special cases if needed.

Before you begin

ATOR protects sensitive messages like password resets and MFA codes. Users must complete identity verification before they can access protected content. For setup details, see End-User Verification and Email Identity Protection.

Before choosing a method, confirm the account is active and syncing.

1. Navigate to Explorer > Accounts.
2. Search for the user and open their account details.
3. Click Settings.
4. Confirm the account has an active Material license and mailbox syncing is enabled.

   

If the account was de-provisioned or its license was removed, Force Unlock Messages is unavailable and delegates cannot help. Re-enable the account in your identity provider first.

Situations and Recommended Method

Situation	Recommended method
User needs access right now, one time	Method 2 (Force Unlock) or Method 4 (Challenge Bypass)
User needs repeated access over time	Method 1 (Add Delegate) or Method 4 (Challenge Bypass)
IT staff need ongoing access to a mailbox	Method 1 (Add Delegate)
User can't retrieve an intercepted password reset email	Method 6 (For password reset loops)
User is being off-boarded	Follow the off-boarding sequence. Use Method 2 for immediate access
Account was de-provisioned before unlocking	Re-enable in your IdP first, then use Method 2
Password reset email isn't being intercepted	Contact support

---

How to help users access protected messages

Method 1: Add a delegate user

Delegates can retrieve messages from another user's mailbox by verifying their own identity. They do not need the account holder's credentials or MFA.

When to use

• Executive assistants managing executive mailboxes
• IT staff who need ongoing access to a user's mailbox
• Managers who need sustained access to a team member's messages

Steps

1. Navigate to Explorer > Accounts.
2. Search for the target user's account, then check the box next to their name.
3. From the bottom toolbar, click Edit Delegates.
4. Search for and add the delegate user(s).
5. Click Save.

Delegates only work on active, syncing accounts. Delegate settings in Material do not change delegate relationships in Microsoft 365 or Google Workspace.

---

Method 2: Force unlock messages

Force unlock temporarily releases messages without requiring end-user verification. Messages relock after the grace period you set.

Force unlock doesn't deliver password reset messages that Material intercepted. See Method 6: For password reset loops.

When to use

• User can't complete MFA verification (lost phone, etc.)
• You need urgent access to specific messages
• E-discovery or legal hold scenarios

Steps

1. Navigate to Explorer > Accounts.
2. Click the row for the user's account to open it.
3. Click All Actions (or CMD+K), then select Force Unlock Messages. This opens a new force unlock request with the account already filled in.
4. Under Request details, set the Date range for the messages you want to unlock.
5. Optionally, under Search criteria, enter a Query to narrow the request to specific messages, then click Search to preview what matches. Leave the query empty to unlock all sensitive messages in the date range.
6. Set the Relock grace period. This controls how long messages stay unlocked before they relock, in hours, days, weeks, or years.
7. Optionally, turn on Completion notification to get an email once all the messages are unlocked.
8. Click Submit request, review the details, then click Yes, unlock messages.

You build the search criteria with MQL, the same query language you use in the Explorer and in custom detections. To start a request without going through an account, from the left navigation expand Email Redaction, click Force Unlock Requests, then click New request. That page also lists your existing requests and their status.

Force Unlock Messages is unavailable when the account has no active Material license or mailbox syncing is disabled.

Unlocking a large number of messages can take many hours, and sometimes several days. Force unlock only affects the original message. Forwarded copies stay locked and must be unlocked separately.

---

Method 3: Disable ATOR protection for a single user

Disabling ATOR protection removes protections for a specific user and returns all protected messages to their mailbox permanently.

When to use

• User is being off-boarded and their messages need permanent access
• Persistent authentication issues that can't be resolved through other methods

Steps

1. Navigate to Explorer > Accounts.
2. Search for and select the user's account.
3. From the bottom toolbar, click Edit Settings.
4. Under Password Reset & App Signup Protection, select Override then toggle off.

   
5. Click Save.
6. Monitor the Material console as messages return to the mailbox.

This is not a quick fix. For large mailboxes, returning protected messages can take weeks or months. For short-term access, use Method 2 or Method 4.

For off-boarding, use this order: disable Sensitive Email Redaction > disable Remediations > remove the license. Reversing the order can leave messages locked with no recovery path. Review Off-board Users for more detail.

To disable Sensitive Email Redaction globally or at the domain level, contact Material Support.

---

Method 4: Create a challenge bypass

A challenge bypass lets users access their protected messages without completing MFA verification. Messages stay locked until the user retrieves them. The bypass removes the verification requirement, not the lock itself.

When to use

• User's MFA device is temporarily unavailable
• User can't retrieve an intercepted password reset email
• User needs to access multiple messages over a period of time
• Testing or troubleshooting scenarios

Steps

1. Navigate to Explorer > Accounts.
2. Search for the user's account, then check the box next to their name.
3. From the bottom toolbar, click All Actions (or cmd+k) > Create Challenge Bypass.
4. Select the Bypass Level:

   • Account: bypass for a specific user. Use this for individual support cases.
   • Domain: bypass for an entire domain
   • Global: bypass for all users across all domains
5. If you selected Account, search for and select the user's email.
6. Set an expiration time for the bypass.
7. Describe the reason for the bypass.
8. Click Save.

Use the narrowest scope that fits the situation. Prefer Account over Domain or Global. To manage existing bypasses, navigate to Settings > End-user Verification or see End-User Verification.

---

Method 5: Re-sync group data after contact changes

Groups sync to Material from your IdP once a day. To force an immediate sync after a user's contact information changes:

Steps

1. Verify the user's information is updated in your IdP.
2. Navigate to Explorer > Groups.
3. Check the box next to the group the user belongs to.
4. From the bottom toolbar, click Resync.

For email address changes, you may need to add the new address as a delegate on the old account until the IdP group sync completes.

Method 6: For password reset loops

A password reset loop occurs when a user needs to reset their password but can't access the intercepted reset email. Start by confirming whether Material intercepted the message.

1. Navigate to Explorer > Accounts.
2. Search their messages for the reset email by subject or sender.

If the message appears in Material: It was intercepted successfully. You have two ways to get the user what they need:

1. Create a challenge bypass (Method 4) so the user can retrieve the reset email without completing verification, then have them finish the reset from their inbox.
2. Read the reset details out of the Message Access Log:

   1. From the left navigation, expand Email Redaction, then click Message Access Log.
   2. Search for and open the message detail view for the end user's email.
   3. In the message tab, right click the password reset option then copy it or highlight and copy the reset code:

   

   1. Send the URL or code to your end user and have them paste it into their browser or reset screen to reset.

Force unlock doesn't deliver an intercepted password reset message, so use one of the two options above. If neither gets the user through the reset, contact Material Support.

---

Other cases

E-discovery scenarios

You have three options for e-discovery access:

• Use Force Unlock (Method 2) to unlock messages in the target mailbox.
• Add the e-discovery team member as a delegate (Method 1) so they can unlock messages as needed, without admin involvement for each one.
• Create a Challenge Bypass (Method 4) for the e-discovery team member.

The delegate or bypass approach works best for ongoing e-discovery, since it gives the team direct, repeated access without requiring an admin for each request.

Off-boarding users

Complete these steps in order:

1. Disable Sensitive Email Redaction in the account's Edit Settings (or contact Support for domain-level changes). The full unlock can take weeks or months for large mailboxes. Use Force Unlock (Method 2) for immediate access in the interim.
2. Disable Remediations in the account's Edit Settings.
3. Remove the license or disable the account in your IdP.

For the broader process, see Off-board Users.

If you remove the license or disable the account before step 1, Material can no longer return protected messages to the mailbox.

Out-of-order off-boarding recovery

If an account was de-provisioned, its license was removed, or it was disabled in your IdP before disabling Sensitive Email Redaction, protected messages remain locked. Force Unlock will not work because Material can no longer sync the mailbox.

To recover:

1. Re-enable the account in your IdP and restore the Material license.
2. Wait up to 30 minutes for Material to re-establish sync.
3. Confirm the Force Unlock Messages button is no longer greyed out.
4. Use Method 2 to unlock the messages.
5. Once messages are unlocked, follow the correct offboarding sequence:

   • Disable Sensitive Email Redaction (toggle off in Edit Settings, or contact Support for domain-level changes)
   • Disable Remediations in the account's Edit Settings
   • Remove the license in your IdP

Password Reset Interception Failures

Password Reset & App Signup Protection covers a broad range of known providers. In some cases, reset emails from a provider that isn't yet covered may arrive in the inbox without triggering a verification step.

How to identify this: The user reports that password reset emails from a specific provider are arriving in their inbox normally, without triggering a verification step.

To resolve:

1. Confirm the provider is one Material should be covering (for example, Salesforce, Okta, or Slack).
2. Have the user forward a sample of the non-intercepted reset email to Material Support.

Coverage for additional providers is managed by Material Support. Contact us for support.