Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Rakesh_M — Mon, 27 Apr 2026 08:06:01 GMT

Hi Community,

I recently faced an issue where I enabled MFA on my PDI, but I lost access to the passkey, and the email account is not properly configured to receive verification codes.However, I also tried disabling MFA via API, but this approach did not work in my case, so I need to explore an alternative way to regain access.

Use Case:
A user is unable to log in to their Personal Developer Instance because their Multi-Factor Authentication is tied to a passkey that was created on an old device, which is no longer available.

Although there is an alternative option to receive a verification code via email, the user is not receiving the MFA email.

As a result, the user is completely locked out of the instance and is looking for a way to reset MFA or regain access without losing existing work.

Approach:

Since I was locked out of the admin account due to MFA, I used another user who still has admin privileges to regain access.

First, I created a scheduled script (via API) that automatically generates a new password for that admin user and logs the temporary password in the system logs.
Then, I used another script to fetch that password from the logs.
With the retrieved password, I logged in using that admin user.
After gaining access, I removed the MFA configuration from the PDI.

In short, I used an alternate admin user, generated a temporary password programmatically, retrieved it from logs, and used it to log back in and fix the MFA issue.

Implementation:
A.Create Scheduled Job to Reset Password

You can find your instance credentials from the ServiceNow Developer Site under Manage My Instance.

As shown in the image below, the highlighted section contains:

Instance URL
Username (usually admin)
Current password

This is the same information you need to use in the script.

Open any Python environment and execute the scripts using your own ServiceNow credentials.
This script creates a scheduled job in ServiceNow that generates a new password for a user and logs it. Here, we are using david.loo as the target user as he has the admin role.

import requests from requests.auth import HTTPBasicAuth import json # ===== CONFIG ===== //Add your credentials here instance = "https://<your-instance>.service-now.com" username = "<admin_username>" password = "<admin_password>" auth = HTTPBasicAuth(username, password) # ===== API URL ===== url = f"{instance}/api/now/table/sysauto_script" # ===== PAYLOAD ===== payload = { "name": "Reset Password Job", "active": "true", "run_type": "once", "script": """ var username = 'david.loo'; var password = SNC.PasswordPolicyEvaluator.generateUserPassword(username); gs.info("My Temporary Password: " + password); var result = SNC.PasswordPolicyEvaluator.setUserPassword(username, password); """, "next_action": "2026-04-27 18:30:00", } headers = { "Content-Type": "application/json", "Accept": "application/json" } # ===== REQUEST ===== response = requests.post(url, auth=auth, headers=headers, data=json.dumps(payload)) # ===== OUTPUT ===== print("Status Code:", response.status_code)

Output:

B.Retrieve Password from Logs:

This script is used to fetch the temporary password that was generated by the scheduled job and stored in the system logs.

import requests from requests.auth import HTTPBasicAuth instance = "https://<your-instance>.service-now.com" username = "<admin_username>" password = "<admin_password>" auth = HTTPBasicAuth(username, password) url = f"{instance}/api/now/table/syslog" params = { "sysparm_query": "messageLIKEMy Tem^sys_created_onONToday@javascript&colon;gs.beginningOfToday()@javascript&colon;gs.endOfToday()", "sysparm_fields": "message", "sysparm_limit": "10" } headers = { "Accept": "application/json" } response = requests.get(url, auth=auth, headers=headers, params=params) data = response.json() for record in data.get("result", []): print(record["message"])

Output:

Open your instance URL in a private/incognito window.
It will prompt you for login credentials.

Username: david.loo
Password: Use the temporary password retrieved from the script output

Then it will prompt you to change the password.Update it with a new password of your choice, and log in again using the updated credentials.

Once logged in, you can access PDI and remove the MFA configuration.

Drawback:
This approach only works if the last active session of the user was in the Global scope. If the user was in a different application scope when they were last logged out, the scheduled script may not execute as expected.

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

jeffreybell — Tue, 19 May 2026 21:28:28 GMT

It's very impressive 😎

Could I ask though, if the PDI had important work on it and we wouldn't want to lose that work, would having backed it up to source control and pulling that work back in to a fresh PDI been a viable solution here? Or was this more of an exercise of 'look at this neat thing I had to do to recover my PDI'?

Either way, +1 from me, thank you for sharing your technique

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Rakesh_M — Wed, 20 May 2026 06:41:24 GMT

Hello @jeffreybell ,

Thank you! Glad you found it useful 😄

Yes, restoring from source control or moving the work to a fresh PDI would definitely be the better approach in most cases.

In my case, I use my PDI a lot for quick development and testing, and over time I lost track of some changes that weren't captured in update sets or source control. Because of that, starting fresh wasn't very easy, so I wanted to find a way to recover the instance instead.

It turned into an interesting recovery exercise, so I decided to share it with the community.

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Ambuj Tripathi — Fri, 21 Aug 2026 19:00:56 GMT

If you still have access to PDI using alternate admin account, another alternate approach is to reset the MFA for the user in focus who has lost the passkey/MFA key (if you still know the password for that user of course).

How as an admin, you can reset the MFA for any other user -

Navigate to below mentioned tables list view and clear the records from each of these tables against the user for whom the MFA passkey or MFA factor is lost.

- user_multifactor_auth (for TOTP)

- sys_user_public_credential (for FIDO Passkey, Mobile Passkey, Security Key or Apple TouchID etc, it may have multiple records if more than one FIDO factor is registered).

- sys_user_multi_factor_setup (Stores all the factors including Email, SMS, TOTP and FIDO setup against a user, may have multiple records).

Once you are done deleting the records from these tables, you should be able to login with the username and password and will be asked to setup MFA again.

Cheers!

question Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification in Platform Privacy & Security forum

Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification

Re: Unable to Access PDI Due to Lost Passkey and Missing MFA Email Verification