Two factors are required. There is no password reset link: an administrator issues a new enrollment invitation instead.