Set up password recovery for users

By default, only super admins can reset a forgotten password using the automated system. Here's how to let users and non-super admins do this:

Now, if users in your organization click Forgot password? on the sign-in page, they get instructions on recovering their password. If users added a recovery phone number or email address to their account, they can reset their password. Users with 2-Step Verification can reset their password only with their recovery email address. Users who haven't added recovery information are directed to contact an administrator.

1. Sign in to your Google Admin console.

   Sign in using your administrator account (does not end in @gmail.com).

2. From the Admin console Home page, go to SecurityAccount recovery.
3. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group.
4. Click User account recovery.
5. Click Allow users and non-super admins to recover their account. This setting won't apply if your organization use single sign-on (SSO) with a third-party identity provider or G Suite Password Sync.
6. Tell users to set up a recovery phone number or email address where they can receive password recovery instructions. 
   Immediately remove a user's recovery information when they leave your organization or if their account might be hijacked. Go to details below.

If you turn on non-admin password recovery, immediately remove a user's recovery information if...

• The user is terminated or leaves your organization. That way they can’t recover their password to access their old account.
• You suspect the account has been hijacked and the user’s recovery information is no longer legitimate.

To remove a user’s recovery information or check if it’s been hacked, sign in to the account as the user. Then follow steps to set up a recovery phone number or email address.

• G Suite for Education users under the age of 18—Younger G Suite for Education users aren’t permitted to add a recovery phone number or email to their account. They can't reset a forgotten password on their own.

  Note: Users of any age with primary or secondary education accounts can't supply a recovery phone number or email. The option to add a phone number or email is not available for these types of accounts.

  Only users with Higher Education accounts, administrators, and teachers using G Suite for Education can supply a recovery phone number or email.

• Organizations using SSO or GSPS—If your organization uses single sign-on (SSO), you won't have the enable non-admin user password recovery option in your Admin console.
  
  If your organization uses G Suite Password Sync for Active Directory (GSPS) and you prevented users from changing their G Suite passwords, users are redirected to Active Directory to reset their passwords. This keeps their Active Directory passwords in sync with G Suite.