> For the complete documentation index, see [llms.txt](https://docs.material.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.material.security/learn-more/risk-areas/password-reset-protection/unlock-messages-for-end-users.md).
# Unlock Messages for End Users
Use these workflows to help end users access password reset messages and other identity-protected content. Start with the quickest method for the situation, then use the special cases if needed.
## Before you begin
ATOR protects sensitive messages like password resets and MFA codes. Users must complete identity verification before they can access protected content. For setup details, see End-User Verification and Password Reset Protection.
Before choosing a method, confirm the account is active and syncing.
1. Navigate to **Explorer** > **Accounts**.
2. Search for the user and open their account details.
3. Click **Settings**.
4. Confirm the account has an active Material license and mailbox syncing is enabled.
{% hint style="warning" %}
If the account was de-provisioned or its license was removed, **Force Unlock Messages** is unavailable and delegates cannot help. Re-enable the account in your identity provider first.
{% endhint %}
### Situations and Recommended Method
| Situation | Recommended method |
| -------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------- |
| User needs access right now, one time | [Method 2](#method-2-force-unlock-messages) (Force Unlock) or [Method 4](#method-4-create-a-challenge-bypass) (Challenge Bypass) |
| User needs repeated access over time | [Method 1](#method-1-add-a-delegate-user) (Add Delegate) or [Method 4](#method-4-create-a-challenge-bypass) (Challenge Bypass) |
| IT staff need ongoing access to a mailbox | [Method 1](#method-1-add-a-delegate-user) (Add Delegate) |
| User is being off-boarded | Follow the off-boarding sequence. Use [Method 2](#method-2-force-unlock-messages) for immediate access |
| Account was de-provisioned before unlocking | Re-enable in your IdP first, then use [Method 2](#method-2-force-unlock-messages) |
| Password reset email isn't being intercepted | See Password Reset Interception Failures |
***
## How to help users access protected messages
### Method 1: Add a delegate user
Delegates can retrieve messages from another user's mailbox by verifying their own identity. They do not need the account holder's credentials or MFA.
**When to use**
* Executive assistants managing executive mailboxes
* IT staff who need ongoing access to a user's mailbox
* Managers who need sustained access to a team member's messages
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for the target user's account, then check the box next to their name.
3. From the bottom toolbar, click **Edit Delegates**.
4. Search for and add the delegate user(s).
5. Click **Save**.
{% hint style="info" %}
Delegates only work on active, syncing accounts. Delegate settings in Material do not change delegate relationships in Microsoft 365 or Google Workspace.
{% endhint %}
***
### Method 2: Force unlock messages
Force unlock temporarily releases messages without requiring end-user verification. Messages re-lock after the re-lock grace period you set.
**When to use**
* User can't complete MFA verification (lost phone, etc.)
* You need urgent access to specific messages
* E-discovery or legal hold scenarios
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Click the row for the user's account to open it.
3. Click **All Actions** (or `CMD+K`), then select **Force Unlock Messages**. This opens the account's message view.
4. Use the date range picker and search bar to filter which messages to unlock. Leave the search bar empty and adjust the date range to target all messages in a given window.
5. Click **Force Unlock Messages**.
6. In the confirmation dialog, set the **Re-lock Grace Period**. This controls how long messages stay unlocked before re-locking. The minimum is 1 day.
7. Optionally, check the box to receive an email notification when the unlock job completes.
8. Click **Yes, unlock messages**.
{% hint style="warning" %}
**Force Unlock Messages** is unavailable when the account has no active Material license or mailbox syncing is disabled.
{% endhint %}
{% hint style="info" %}
Unlocking a large number of messages can take many hours, and sometimes several days. Force unlock only affects the original message. Forwarded copies stay locked and must be unlocked separately.
{% endhint %}
***
### Method 3: Disable ATOR protection for a single user
Disabling ATOR protection removes protections for a specific user and returns all protected messages to their mailbox permanently.
**When to use**
* User is being off-boarded and their messages need permanent access
* Persistent authentication issues that can't be resolved through other methods
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for and select the user's account.
3. From the bottom toolbar, click **Edit Settings**.
4. Under **Password Reset & App Signup Protection**, select **Override** then toggle **off.**
5. Click **Save**.
6. Monitor the Material console as messages return to the mailbox.
{% hint style="warning" %}
This is not a quick fix. For large mailboxes, returning protected messages can take weeks or months. For short-term access, use Method 2 or Method 4.
{% endhint %}
{% hint style="danger" %}
For off-boarding, use this order: disable **Sensitive Email Redaction** > disable Remediations > remove the license. Reversing the order can leave messages locked with no recovery path.\
\
Review Off-board Users for more detail.
{% endhint %}
{% hint style="info" %}
To disable **Sensitive Email Redaction** globally or at the domain level, contact Material Support.
{% endhint %}
***
### Method 4: Create a challenge bypass
A challenge bypass lets users access their protected messages without completing MFA verification. Messages stay locked until the user retrieves them. The bypass removes the verification requirement, not the lock itself.
**When to use**
* User's MFA device is temporarily unavailable
* User needs to access multiple messages over a period of time
* Testing or troubleshooting scenarios
**Steps**
1. Navigate to **Explorer** > **Accounts**.
2. Search for the user's account, then check the box next to their name.
3. From the bottom toolbar, click All Actions (or `cmd+k`) > **Create Challenge Bypass**.
4. Select the **Bypass Level**:
* **Account**: bypass for a specific user. Use this for individual support cases.
* **Domain**: bypass for an entire domain
* **Global**: bypass for all users across all domains
5. If you selected **Account**, search for and select the user's email.
6. Set an expiration time for the bypass.
7. Describe the reason for the bypass.
8. Click **Save**.
{% hint style="success" %}
Use the narrowest scope that fits the situation. Prefer **Account** over **Domain** or **Global**. To manage existing bypasses, go to **Settings** > **End-user Verification** or see End-User Verification.
{% endhint %}
***
### Method 5: Re-sync group data after contact changes
Groups sync to Material from your IdP once a day. To force an immediate sync after a user's contact information changes:
**Steps**
1. Verify the user's information is updated in your IdP.
2. Navigate to **Explorer** > **Groups**.
3. Check the box next to the group the user belongs to.
4. From the bottom toolbar, click **Resync**.
{% hint style="info" %}
For email address changes, you may need to add the new address as a delegate on the old account until the IdP group sync completes.
{% endhint %}
***
## Other cases
E-discovery scenarios
You have three options for e-discovery access:
* Use Force Unlock (Method 2) to unlock messages in the target mailbox.
* Add the e-discovery team member as a delegate (Method 1) so they can unlock messages as needed, without admin involvement for each one.
* Create a Challenge Bypass (Method 4) for the e-discovery team member.
The delegate or bypass approach works best for ongoing e-discovery, since it gives the team direct, repeated access without requiring an admin for each request.
Off-boarding users
Complete these steps in order:
1. Disable Sensitive Email Redaction in the account's **Edit Settings** (or contact Support for domain-level changes). The full unlock can take weeks or months for large mailboxes. Use Force Unlock (Method 2) for immediate access in the interim.
2. Disable Remediations in the account's **Edit Settings**.
3. Remove the license or disable the account in your IdP.
For the broader process, see Off-board Users.
{% hint style="warning" %}
If you remove the license or disable the account before step 1, Material can no longer return protected messages to the mailbox.
{% endhint %}
Out-of-order off-boarding recovery
If an account was de-provisioned, its license was removed, or it was disabled in your IdP before disabling Sensitive Email Redaction, protected messages remain locked. Force Unlock will not work because Material can no longer sync the mailbox.
To recover:
1. Re-enable the account in your IdP and restore the Material license.
2. Wait up to 30 minutes for Material to re-establish sync.
3. Confirm the **Force Unlock Messages** button is no longer greyed out.
4. Use Method 2 to unlock the messages.
5. Once messages are unlocked, follow the correct offboarding sequence:
* Disable Sensitive Email Redaction (toggle off in **Edit Settings**, or contact Support for domain-level changes)
* Disable Remediations in the account's **Edit Settings**
* Remove the license in your IdP
Password Reset Interception Failures
Password Reset & App Signup Protection covers a broad range of known providers. In some cases, reset emails from a provider that isn't yet covered may arrive in the inbox without triggering a verification step.
**How to identify this:** The user reports that password reset emails from a specific provider are arriving in their inbox normally, without triggering a verification step.
**To resolve:**
1. Confirm the provider is one Material should be covering (for example, Salesforce, Okta, or Slack).
2. Have the user forward a sample of the non-intercepted reset email to Material Support.
{% hint style="info" %}
Coverage for additional providers is managed by Material Support. Contact us for support.
{% endhint %}
Password Reset loops
A password reset loop occurs when a user needs to reset their password but can't access the intercepted reset email. Start by confirming whether Material intercepted the message.
1. Navigate to **Explorer** > **Accounts**.
2. Search their messages for the reset email by subject or sender.
**If the message appears in Material:** It was intercepted successfully. Use Force Unlock (Method 2) or Challenge Bypass (Method 4) to return it to the user's inbox, then have the user complete the reset from there.
**If the message doesn't appear in Material:** Interception may have failed silently. See Password Reset Interception Failures below.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.material.security/learn-more/risk-areas/password-reset-protection/unlock-messages-for-end-users.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
