What if they have access to some users' emails and then can selectively fire off password reset emails to them? It's probably less likely, but could be a vector.
It still sounds to me like they're saying that they could set the password on an account to anything they wanted, but not retrieve an existing password.
This would be a big red flag to anyone who's observant and realizes that their password had been changed, but plenty of people would probably simply take it in stride and reset their password thinking they'd forgotten it. Either way the horse is out of the barn.
Anyway I agree it would be bad practice but that doesn't mean it's not done.
Really? That's insane. I'd like to hear more about that.
I have no idea what an Okta support engineer can or can't do but I know that a regular account administrator can set an arbitrary password for a given user via the Okta UI.
Then those users are hosed anyway? They could always trigger a normal user-facing password reset email without any access to support systems.