OCR for Education uses a setup-link workflow so a password is created by the user in the browser rather than transmitted in an email.
Use the single-use setup link and sign in after completion
-
Open the setup link
Select the time-limited link in the invitation or password-reset email. The link is single-use and should not be forwarded.
-
Create the password
Enter and confirm a new password on the browser page. After successful setup, the user is redirected to the login page and signs in with the new password.
-
Request recovery carefully
Use Forgot Password only when needed. Requests are rate-limited by IP and email to reduce automated abuse; repeated requests may temporarily block further attempts.
Support staff should issue a new setup link rather than asking for, receiving, or sending a user password.
Recovery throttling
A single IP is limited to one forgot-password attempt in a five-minute window. Five attempts in the rolling protection window trigger a temporary ten-minute block, and ten attempts within the larger protection window trigger a one-hour IP block. An email address also receives a cooldown so repeated requests do not generate unlimited active links.
Recommended next step
If the link has expired or was already used, request a new one from the relevant account workflow.