In the same way that SSO administrators can perform password resets and email address changes, they can also handle certain Two-Factor security activities on behalf of an employee.
For instance, if an employee loses his/her cell phone and is concerned about the integrity of his/her SSO account, a SSO administrator can help.
Learn more about administering two factor authentication in SSO.