{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":40458,"path":"platform-security/authentication/config-acr.md","title":"Configure an account recovery user","bundle":null,"doc_type":null,"release":"australia","body":"\n# Configure an account recovery user\n\nConfigure an account recovery user to perform account recovery activities on your instance.\n\nAn account recovery user is a user account that administrators can use to perform account recovery tasks, such as addressing an SSO misconfiguration or addressing expired certificates.\n\n**Note:**\n\n-   If you're using account recovery on your instance, you must configure an account recovery user. This step is necessary before enabling multiple-provider single sign-on on an instance.\n-   Enabling ACR disables the local interactive log-ins \\(username or password based\\) when SSO is enabled to your instances.\n\n## Configure an account recovery user from the Account Recovery Properties page\n\nConfigure an account recovery from the Account Recovery properties page.\n\n### Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\nFor a fresh instance to configure ACR, you must do the following:\n\n-   Activate Mutli-SSO plugin \\(`com.snc.integration.sso.multi.installer`\\)\n-   Enable ACR \\(`glide.sso.acr.enabled`\\) - This is enabled by default in case of a fresh instance.\n-   Before enabling SSO property \\(`glide.authenticate.multisso.enabled`\\), the administrator must enroll as an ACR user.\n-   Administrator must set a password for local login and register MFA before enrolling as an ACR user.\n\nFor an upgraded instance to use ACR, you must do the following:\n\n-   Activate Mutli-SSO plugin \\(`com.snc.integration.sso.multi.installer`\\)\n-   Enable ACR \\(`glide.sso.acr.enabled`\\)\n\n    **Note:** In case of upgraded instance, the administrator must enable ACR.\n\n-   Before enabling SSO property \\(`glide.authenticate.multisso.enabled`\\), the administrator must enroll as an ACR user.\n\n    **Note:** Setting this property to false will not disable multi-provider SSO if Account Recovery \\(ACR\\) is also enabled on the instance. To log in with a username and password ACR must also be disabled using the **glide.sso.acr.enabled** property. For details on this property see [Account recovery properties](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/authentication/acr-properties.md).\n\n-   Administrator must set a password for local login and register MFA before enrolling as an ACR user.\n\n### Procedure\n\n1.  Navigate to **All** > **Account Recovery** > **Properties**.\n\n2.  Select **Enable account recovery**.\n\n    **Note:** You need to enable account recovery when SSO is enable. Account recovery users will be limited to SSO configuration and troubleshooting-related tasks.\n\n3.  Select the **here** text in the Step 2.\n\n    \\[Omitted image \"acct-recover-click.png\"\\] Alt text: Account recovery warning with a link to account recovery setup\n\n4.  Following the on-screen directions in the **Configure account recovery for Multi-SSO** modal.\n\n    \\[Omitted image \"acct-recover-setup.png\"\\] Alt text: Configure account recovery for Multi-SSO modal\n\n    After completing the on-screen steps, the **Enable account recovery** is enabled.\n\n5.  Select **Enable account recovery**.\n\n6.  Select **Save**.\n\n\n### Result\n\nYou have configured your user account as an account recovery user. You can verify this account, and see any other configured account recovery users by navigating to **Multi-Provider SSO** > **Account Recovery** > **Users**.\n\n## Configure an account recovery user from an admin user profile\n\nConfigure an administrator as an account recovery user from the admin user profile.\n\n### Before you begin\n\nRole required: sso\\_config\\_admin, business\\_rule\\_admin, script\\_include\\_admin\n\n### Procedure\n\n1.  Log into your instance using an administrator account.\n\n2.  Click on the user name in the instance header, and select **Profile**.\n\n    \\[Omitted image \"user-profile-1.png\"\\] Alt text: User profile location\n\n3.  In the **User** form, click **Enable Account Recovery** in the **Related Links** section.\n\n    \\[Omitted image \"user-profile-2.png\"\\] Alt text: User profile location\n\n    **Note:**\n\n    If the selected user already has account recovery enabled, **Enable Account Recovery** does not appear in the related links. There will be a **Disable Account Recovery** option instead.\n\n4.  Following the on-screen directions in the **Configure account recovery for Multi-SSO** modal.\n\n    \\[Omitted image \"acct-recover-setup.png\"\\] Alt text: Configure account recovery for Multi-SSO modal\n\n    After completing the on-screen steps, the **Enable account recovery** is enabled.\n\n5.  Click **Enable account recovery**.\n\n\n### Result\n\nYou have configured your user account as an account recovery user. You can verify this account, and see any other configured account recovery users by navigating to **Multi-Provider SSO** > **Account Recovery** > **Users**.\n\n"}}