Identity & Access Management · Lesson 2 of 8
Authentication, sessions, and recovery
Authentication verifies a claimed identity. A session may keep access active after sign-in, while recovery restores access when normal methods cannot be used.
Three access decisions to protect
Illustrative account lifecycle checkpoints.
| Checkpoint | Control question | Common mistake |
|---|---|---|
| Sign-in | Authenticate with approved factors | Two passwords are one factor type |
| Active session | Check session and token behavior | A password reset may not revoke every session |
| Recovery | Verify through the approved procedure | A title or urgent request is not proof of identity |
Read the visualWhat should happen before an urgent MFA reset?
Verify the requester through the approved recovery route and obtain required approval.
Use distinct factors
MFA combines different factor types. Two passwords are still the same type of factor.
Treat recovery as sensitive
Follow identity-verification and approval procedures for resets. Urgency is not proof of identity.
Check session behavior
Resetting a password may not revoke all existing sessions or tokens. Follow platform guidance and the approved response process.
Put it in context
Someone calls claiming to be an executive and requests an MFA reset. You use the established verification route instead of trusting their title or deadline.
Recovery and active sessions deserve the same care as sign-in.
Read the sources
Make it stick.
Try one short question to check your understanding and save this lesson to your progress.