A staff account with no second factor can no longer add its first one with its password alone. A platform owner makes a one-time enrolment link in the console; it names one account, lasts 24 hours, works once, and a newer link ends the older. Owners can list and remove a staff account’s passkeys, which signs that account out everywhere and stops its push notifications. Each of these is written to the staff record, and the console can make a new set of recovery codes.
The console’s People section lists the accounts waiting to be deleted, soonest first, and support can cancel one when its owner asks; the person is emailed to say so. Listing them is recorded without their addresses.