Example workflow when changing a site's identify provider

Question

I'm switching a site from ADFS/AD to Azure B2C/AAD and require users to reset their password. Users will also see different log in screens. I'm struggling to find an approach where users won't be scared that my site's been hacked, worried that reset password emails are phishing attacks etc.

My plan is to ask users to sign into the site the using their existing credentials, explain the situation and ask them to reset their password... (I would need to track who completes the progress, keep the existing infrastructure alive, and one day worry about a bulk import of the remaining users)

I've also thought about doing a bulk transfer and automating password reset emails to everyone... my concern is that this would scare people....

Could anyone suggest a less intrusive method or an example of a company who has done this well?

Thank you

Answer 1

2 things here : 1) How to tell my users that they have to change their password ? 2) How to implement it in a nice and softy flow

For the 1) I would say that it depends on the situation. Evaluate how bad it can affect your business or, a contrario, how good you can use this to promote your brand like : "Yeah, we had an issue, we fix it FAST to provide you the best service possible" (ok, the text has to be more worked, but you get the idea). Works probably very well if you're a small company and you're bound to other ones with emotionnal link. If it affects in a bad way, explain them that you change the way you manage their passwords (If they're IT type of users, tell them the whole thing) to enhance their protection and they should change it.

2) The way you proposed was really great! They connect => Little message telling them to change their password because ABCD => New password. Fits in the best way in the User Journey. Still, for those that doesn't connect to their account for a certain amount of time (depending on your kind of business), send them an email telling them the SAME story! (and a nice link to change the password).

Try to evaluate before everything how to say things : Do not be "Shady" like "Yeah. This is for this. Hem. Please." Be honest, but in a way that won't affect your brand identity/your business.

Hope this will help.