Sometimes you may want to grant password reset privileges to more than just your system administrators. It might be beneficial to have certain groups of users be capable of resetting passwords for other groups of users.
For example, a school might allow it's teachers to reset students' passwords, but only allow the IT department to reset teachers' passwords. The students will only have to contact their teachers to have their passwords reset and the IT department won't have to reset nearly as many passwords, so this should save everyone a lot of time.
Configuring who can reset a password for who is very easy to do with the Guardians feature!
Guardians can also perform MFA Authentications for the users that they are Guardian over!
You can begin creating Guardians after you have defined your Access Rules.
- From the admin dashboard (https://admin.clearlogin.com), start by selecting Security and then click on Guardians on the navigation bar.
- You will be brought to the Guardians configuration page. Click on the green plus button that says Add New Password Guardian to begin.
- Now that you're at the New Guardian page, you're ready to make your first Guardian rule!
As you can see in both this and the previous screenshot, Guardian rules are defined in a very simple manner. Anyone that matches a specific Access Rule (in this case, Teachers) is a Guardian for anyone that matches another Access Rule (in this case, Students and Parents).
To define who is a Guardian, select the Access Rule that matches who you want to allow to be a Guardian from the dropdown menu at the top.
To define which users' accounts that you're allowing to be reset (you can enter multiple groups) by the Guardians, click in the bottom text field and then either type the Access Rule names that match the users and press enter after each one, or click on them in the list that auto-populates beneath the text field.
- Once you're done, click on the green button that says Save Guardian.
You will be brought back to the Guardians page and you should see your new rule.
Congratulations, you have successfully created a Guardian Rule!
Please note that you can click on the blue Edit button next to a Guardian rule to modify it, and that you can click on the red X button next to a Guardian rule to delete it.