1. You can only reset the password/MFA of
confirmed users.
2. You cannot reset the password for users with
unconfirmed (with an Yet to Verify tag) verified-domain email address. Once the user approves it, the email address can be used to reset the password.