Credential Governance
Unlock Account
Locked-out users unlock their own accounts, on the systems they pick, after proving who they are.
Completes when the systems you picked report the account unlocked.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Unlock Account from the AI Assistant You Already Use
Same verification workflow as the web app, run as a fresh challenge in the conversation. Unlock Account unlocks your own accounts only. One completed unlock = one Secure Outcome; failed attempts are never billed.
You: I'm locked out. Unlock my account. Avatier: verify: passed · system: Active Directory · result: unlocked · password: unchanged
Why it matters
A Lockout Should Not Wait in the Help Desk Queue.
A locked account stops work until someone clears it, and clearing it by hand means a call, an identity check and a wait.
What an unlock needs
Proof that the person is who they say, with the methods your verification workflow allows, then the lockout cleared on each system they pick, with the password left as it is.
What goes wrong by hand
Clearing a lockout over the phone depends on whoever answers checking identity the same way every time, with no per-system record of what was unlocked.
What Unlock Account does
The person verifies, picks the systems (every eligible one is preselected) and sees each system's result. Each system's unlock is written to the activity log.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether anyone is locked out this month or not. Pay Per Identity Action™ charges only for completed unlocks.
The Action
How Unlock Account Runs
On the web, Unlock Account runs from the sign-in page or the signed-in tile. In Avabot and MCP you ask to unlock your account, pass a challenge in chat and pick the systems by number.
Start the Unlock
Before sign-in, type your user name on the sign-in page, choose Unlock Account and pass the CAPTCHA check. Signed in, open the Unlock Account tile. In Avabot, ask to unlock your account: Avabot uses your signed-in identity or asks for your email or user ID, and refuses a request that names someone else.
Verify Your Identity
Answer the challenge your tenant's Password Management authentication workflow sets, with the methods your policy already allows, such as Security Questions, an SMS or email code, Google or Microsoft Authenticator, PingID Push or the Identity Challenge Card. Before sign-in this is always required; signed in, it is on by default. Avabot and MCP always run their own challenge in chat from the same workflow, even after a recent connector sign-in.
Pick the Systems
Every eligible system is preselected; untick any you want to leave alone. In Avabot, pick the systems by number. Systems an admin marks 'never unlock' are not listed.
See the Results
The results page shows each system's outcome, and one system can succeed while another fails. The unlock runs at once, with no approval and no justification, and does not change the password.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
Unlock Account needs you to be enrolled in Password Management, with at least one usable verification method.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. An unlock completes when the systems you picked report the account unlocked. The results page shows each system's outcome, and partial success is possible. It runs at once and creates no request. One completed unlock = one Secure Outcome.
Evidence
- An activity-log entry for each system unlocked (also sent to syslog or your SIEM)
- The Account Unlock audit report
- The results page, with each system's outcome
- A results email, when your tenant's unlock email template is on
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Unlock
Pay per completed unlock. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Unlock Account, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed unlocks only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | The lockout is cleared on each system the person picks, after they verify, with the password unchanged |
| Evidence | Silent failures and missing audit trails | An activity-log entry for each system and the Account Unlock audit report |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Systems an Unlock Touches
Unlock Account clears the lockout in Active Directory and in other connected systems whose connector supports unlock, such as LDAP directories and connected apps.
- LDAP
- Microsoft
- Active Directory accounts are unlocked. Entra ID has no unlock operation, so it reports 'not supported'.
- Connected Apps
- Apps whose connector supports unlock. Systems an admin marks 'never unlock' are hidden.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Can I unlock my account if I can't sign in?
Yes. Type your user name on the sign-in page, choose Unlock Account, pass the CAPTCHA and verify your identity. No password is needed.
Does unlocking reset my password?
No. It only clears the lockout on the systems you pick. To set a new password, use Forgot Password.
Can I unlock a colleague's account through Avabot?
No. Avabot and MCP refuse requests that name someone else. Help desk staff use Assisted Unlock in the web app.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Unlock Account
You've Automated the System. Now Secure the Credentials.
Locked-out users verify, pick their systems and get back to work, with each unlock in the activity log.