AO coverage. Addresses the single Temporary Passwords objective: an immediate change to a permanent credential is required when a temporary one is used to log on.

Reset path. The help desk issues a one-time-use credential valid for 60 minutes. The account is simultaneously flagged for credential change at next sign-in, so the session stops at the change prompt and cannot reach enclave applications until a permanent credential exists. Where the user still has a working security key, the preferred path is re-registration of that key rather than issuing a password at all.

Identity proofing before issuance. A scripted challenge covers items not visible in a phishing pretext; for anyone on the privileged inventory the technician additionally calls the manager on a number from the directory. The requester can never approve their own reset, and the proofing method used is recorded in the ticket.

Onboarding. Day-one access uses the same one-time credential, consumed in person or on a video call during the security-key registration ceremony, so a new hire never holds a reusable temporary password.

Maintenance. Monthly reconciliation of credentials issued versus consumed versus expired; anything unconsumed is invalidated automatically and the mismatch is reviewed. Quarterly review of the proofing script against current social-engineering patterns.

Accepted gap. One legacy on-prem application cannot set a change-at-next-logon flag. There, the administrator sets the temporary value and watches the user change it within the same session, recording completion in the ticket. The application is scheduled for SSO integration.

• IdP configuration showing one-time use and the 60-minute lifetime
• Change-at-next-sign-in flag applied on a sample reset
• Help-desk proofing script and a completed ticket recording the method used
• Monthly issued/consumed/expired reconciliation report
• Legacy application procedure and a completed witnessed-change ticket