> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/email-protections/email-identity-protection/unlock-messages-for-end-users.md).
# Unlock Messages for End Users
Use these workflows to help end users access password reset messages and other identity-protected content. Start with the quickest method for the situation, then use the special cases if needed.
## Before you begin
ATOR protects sensitive messages like password resets and MFA codes. Users must complete identity verification before they can access protected content. For setup details, see End-User Verification and Email Identity Protection.
Before choosing a method, confirm the account is active and syncing.
1. Navigate to **Explorer** > **Accounts**.
2. Search for the user and open their account details.
3. Click **Settings**.
4. Confirm the account has an active Material license and mailbox syncing is enabled.
{% hint style="warning" %}
If the account was de-provisioned or its license was removed, **Force Unlock Messages** is unavailable and delegates cannot help. Re-enable the account in your identity provider first.
{% endhint %}
### Situations and Recommended Method
| Situation | Recommended method |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| User needs access right now, one time | [Method 2](#method-2-force-unlock-messages) (Force Unlock) or [Method 4](#method-4-create-a-challenge-bypass) (Challenge Bypass) |
| User needs repeated access over time | [Method 1](#method-1-add-a-delegate-user) (Add Delegate) or [Method 4](#method-4-create-a-challenge-bypass) (Challenge Bypass) |
| IT staff need ongoing access to a mailbox | [Method 1](#method-1-add-a-delegate-user) (Add Delegate) |
| User can't retrieve an intercepted password reset email | [Method 6](#method-6-for-password-reset-loops) (For password reset loops) |
| User is being off-boarded | Follow the off-boarding sequence. Use [Method 2](#method-2-force-unlock-messages) for immediate access |
| Account was de-provisioned before unlocking | Re-enable in your IdP first, then use [Method 2](#method-2-force-unlock-messages) |
| Password reset email isn't being intercepted | Contact support |
***
## How to help users access protected messages
### Method 1: Add a delegate user
Delegates can retrieve messages from another user's mailbox by verifying their own identity. They do not need the account holder's credentials or MFA.
**When to use**
* Executive assistants managing executive mailboxes
* IT staff who need ongoing access to a user's mailbox
* Managers who need sustained access to a team member's messages
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for the target user's account, then check the box next to their name.
3. From the bottom toolbar, click **Edit Delegates**.
4. Search for and add the delegate user(s).
5. Click **Save**.
{% hint style="info" %}
Delegates only work on active, syncing accounts. Delegate settings in Material do not change delegate relationships in Microsoft 365 or Google Workspace.
{% endhint %}
***
### Method 2: Force unlock messages
Force unlock temporarily releases messages without requiring end-user verification. Messages relock after the grace period you set.
{% hint style="warning" %}
Force unlock doesn't deliver password reset messages that Material intercepted. See [Method 6: For password reset loops.](#method-6-for-password-reset-loops)
{% endhint %}
**When to use**
* User can't complete MFA verification (lost phone, etc.)
* You need urgent access to specific messages
* E-discovery or legal hold scenarios
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Click the row for the user's account to open it.
3. Click **All Actions** (or `CMD+K`), then select **Force Unlock Messages**. This opens a new force unlock request with the account already filled in.
4. Under **Request details**, set the **Date range** for the messages you want to unlock.
5. Optionally, under **Search criteria**, enter a **Query** to narrow the request to specific messages, then click **Search** to preview what matches. Leave the query empty to unlock all sensitive messages in the date range.
6. Set the **Relock grace period**. This controls how long messages stay unlocked before they relock, in hours, days, weeks, or years.
7. Optionally, turn on **Completion notification** to get an email once all the messages are unlocked.
8. Click **Submit request**, review the details, then click **Yes, unlock messages**.
{% hint style="info" %}
You build the search criteria with MQL, the same query language you use in the Explorer and in custom detections. To start a request without going through an account, from the left navigation expand **Email Redaction**, click **Force Unlock Requests**, then click **New request**. That page also lists your existing requests and their status.
{% endhint %}
{% hint style="warning" %}
**Force Unlock Messages** is unavailable when the account has no active Material license or mailbox syncing is disabled.
{% endhint %}
{% hint style="info" %}
Unlocking a large number of messages can take many hours, and sometimes several days. Force unlock only affects the original message. Forwarded copies stay locked and must be unlocked separately.
{% endhint %}
***
### Method 3: Disable Email Redaction for a single user
Disabling Email Redaction for a user returns all redacted messages to their mailbox permanently.
**When to use**
* User is being off-boarded and their messages need permanent access
* Persistent authentication issues that can't be resolved through other methods
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for and select the user's account.
3. From the bottom toolbar, click **Edit Settings**.
4. Under **Remediations**, select **Override Email Redaction**, then toggle it **Off**.
5. Click **Save**.
6. Monitor the Material console as messages return to the mailbox.
{% hint style="warning" %}
This is not a quick fix. For large mailboxes, returning protected messages can take weeks or months. For short-term access, use Method 2 or Method 4.
{% endhint %}
{% hint style="danger" %}
For off-boarding, use this order: disable **Email Redaction** > disable Remediations > remove the license. Reversing the order can leave messages locked with no recovery path.\
\
Review Off-board Users for more detail.
{% endhint %}
{% hint style="info" %}
To disable **Email Redaction** globally or at the domain level, contact Material Support.
{% endhint %}
***
### Method 4: Create a challenge bypass
A challenge bypass lets users access their protected messages without completing MFA verification. Messages stay locked until the user retrieves them. The bypass removes the verification requirement, not the lock itself.
**When to use**
* User's MFA device is temporarily unavailable
* User can't retrieve an intercepted password reset email
* User needs to access multiple messages over a period of time
* Testing or troubleshooting scenarios
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for the user's account, then check the box next to their name.
3. From the bottom toolbar, click All Actions (or `cmd+k`) > **Create Challenge Bypass**.
4. Select the **Bypass Level**:
* **Account**: bypass for a specific user. Use this for individual support cases.
* **Domain**: bypass for an entire domain
* **Global**: bypass for all users across all domains
5. If you selected **Account**, search for and select the user's email.
6. Set an expiration time for the bypass.
7. Describe the reason for the bypass.
8. Click **Save**.
{% hint style="success" %}
Use the narrowest scope that fits the situation. Prefer **Account** over **Domain** or **Global**. To manage existing bypasses, navigate to **Settings** > **End-user Verification** or see End-User Verification.
{% endhint %}
***
### Method 5: Re-sync group data after contact changes
Groups sync to Material from your IdP once a day. To force an immediate sync after a user's contact information changes:
**Steps**
1. Verify the user's information is updated in your IdP.
2. Navigate to **Explorer** > **Groups**.
3. Check the box next to the group the user belongs to.
4. From the bottom toolbar, click **Resync**.
{% hint style="info" %}
For email address changes, you may need to add the new address as a delegate on the old account until the IdP group sync completes.
{% endhint %}
### Method 6: For password reset loops
A password reset loop occurs when a user needs to reset their password but can't access the intercepted reset email. Start by confirming whether Material intercepted the message.
1. Navigate to **Explorer** > **Accounts**.
2. Search their messages for the reset email by subject or sender.
**If the message appears in Material:** It was intercepted successfully. You have two ways to get the user what they need:
1. **Create a challenge bypass** ([Method 4](#method-4-create-a-challenge-bypass)) so the user can retrieve the reset email without completing verification, then have them finish the reset from their inbox.
2. **Read the reset details out of the Message Access Log:**
1. From the left navigation, expand **Email Redaction**, then click **Message Access Log**.
2. Search for and open the message detail view for the end user's email.
3. In the message tab, right click the password reset option then copy it or highlight and copy the reset code:
4. Send the URL or code to your end user and have them paste it into their browser or reset screen to reset.
{% hint style="warning" %}
Force unlock doesn't deliver an intercepted password reset message, so use one of the two options above. If neither gets the user through the reset, contact Material Support.
{% endhint %}
***
## Other cases
E-discovery scenarios
You have three options for e-discovery access:
* Use Force Unlock (Method 2) to unlock messages in the target mailbox.
* Add the e-discovery team member as a delegate (Method 1) so they can unlock messages as needed, without admin involvement for each one.
* Create a Challenge Bypass (Method 4) for the e-discovery team member.
The delegate or bypass approach works best for ongoing e-discovery, since it gives the team direct, repeated access without requiring an admin for each request.
Off-boarding users
Complete these steps in order:
1. Disable Email Redaction in the account's **Edit Settings** (or contact Support for domain-level changes). The full unlock can take weeks or months for large mailboxes. Use Force Unlock (Method 2) for immediate access in the interim.
2. Disable Remediations in the account's **Edit Settings**.
3. Remove the license or disable the account in your IdP.
For the broader process, see Off-board Users.
{% hint style="warning" %}
If you remove the license or disable the account before step 1, Material can no longer return protected messages to the mailbox.
{% endhint %}
Out-of-order off-boarding recovery
If an account was de-provisioned, its license was removed, or it was disabled in your IdP before disabling Email Redaction, protected messages remain locked. Force Unlock will not work because Material can no longer sync the mailbox.
To recover:
1. Re-enable the account in your IdP and restore the Material license.
2. Wait up to 30 minutes for Material to re-establish sync.
3. Confirm the **Force Unlock Messages** button is no longer greyed out.
4. Use Method 2 to unlock the messages.
5. Once messages are unlocked, follow the correct offboarding sequence:
* Disable Email Redaction (toggle off in **Edit Settings**, or contact Support for domain-level changes)
* Disable Remediations in the account's **Edit Settings**
* Remove the license in your IdP
Password Reset Interception Failures
Email Identity Protection covers a broad range of known providers. In some cases, reset emails from a provider that isn't yet covered may arrive in the inbox without triggering a verification step.
**How to identify this:** The user reports that password reset emails from a specific provider are arriving in their inbox normally, without triggering a verification step.
**To resolve:**
1. Confirm the provider is one Material should be covering (for example, Salesforce, Okta, or Slack).
2. Have the user forward a sample of the non-intercepted reset email to Material Support.
{% hint style="info" %}
Coverage for additional providers is managed by Material Support. Contact us for support.
{% endhint %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.material.security/email-protections/email-identity-protection/unlock-messages-for-end-users.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
