Okta migration with Password Inline Hook – what to do if STAGED users forget their legacy password?

Hello everyone! I am relatively new to Okta and I was wondering if anyone might have some advice on the following:

We’re migrating from Sentry to Okta. User credentials are currently stored in a Sentry database. The plan is:

• Use a custom migration tool to create users in Okta without passwords
• Users will land in Okta with STAGED status
• We’ll use a Password Inline Hook + our credential validation API to validate the password against the legacy datastore on first login

That part is clear to me.

The issue is with users who don’t remember their legacy password and are STAGED status

• They can’t authenticate
• They can’t trigger the inline hook
• Okta can’t send recovery emails to STAGED users

So they’re effectively stuck

We’re trying to avoid manual helpdesk/admin intervention.

Has anyone handled a similar scenario before ?