Password change and account recovery

Product Zbix CRM · Version 1.2.0 · Source reviewed · Reviewed 28 October 2026
Audience Administrators and implementation teams · Deployment All supported models

Overview

A signed-in user can change their password using the current password. The login recovery flow can email a short-lived, single-use reset link when outbound SMTP and the recovery configuration are available. The link expires after 30 minutes. A successful reset invalidates outstanding links bound to the previous password and revokes existing sessions.

Purpose

Use the supported recovery path to restore access without exposing passwords or modifying database hashes.

Prerequisites

• For a normal change, the current password and a signed-in session.

• For an email reset, an active account with access to its mailbox and enabled SMTP recovery delivery.

Procedure

1. If signed in, open Settings, locate Password & security, enter the current password and a new password of 12 to 1,024 characters, then save.

2. Sign in again with the new password after the change completes. Complete MFA if the account has an enrolled factor.

3. If unable to sign in, use the password recovery option and enter the account email. The response is deliberately generic and does not confirm account existence.

4. Open the latest reset link in the intended CRM origin before it expires, set the new password, then sign in normally.

5. If no message arrives, ask the workspace administrator to check account activity and SMTP delivery configuration. An administrator can send the supported recovery link or use the authorized user-management password process.

Expected result

The account has a new password, prior sessions are invalidated and normal MFA protection remains in place.

Important notes

• A reset link is sensitive authentication material. Do not paste it into tickets, screenshots or public documentation.

• The reset response does not prove email delivery. SMTP acceptance and mailbox arrival must be distinguished.

• An expired or already-used link requires a new request. Reusing the old link does not extend its validity.

• Password recovery is separate from MFA recovery; replacing a password does not supply a missing authenticator.

Troubleshooting

• No reset email: check spam/quarantine and ask the administrator to review the configured sender and safe SMTP diagnostic status.

• Invalid or expired reset link: request a new link and use it once within the validity period.

Related articles

• Manage sessions and sign out other devices

• Authenticator enrollment and organization MFA policy

• Configure SMTP email delivery