Is there a security concern when a user receives an ArcGIS Online password reset notification email without requesting for one?

Answer

No. Receiving an ArcGIS Online password reset notification email does not imply a security issue or enable other users to access a user’s account. The ArcGIS Online account owner receives the email if a password reset is requested by anyone with the knowledge of the account owner’s username.

Note:
An ArcGIS Online public account username is visible to everyone.

There are no tools to track users requesting or receiving these emails, and these emails are not recorded in the ArcGIS Online activity log. However, the ArcGIS Online organization's administrator can tighten the organization's security by implementing the following security options.

Configure the security settings of the organization

In ArcGIS Online, request a default administrator or a user with the Security and infrastructure administrative privilege to configure the organization’s security settings. The administrator can set a password policy to enable more secure passwords, set a multifactor authentication for extra security, and disable anonymous users from viewing the profile of other users of the organization.

Integrate SAML (Security Assertion Markup Language) login

Set up SAML logins for the ArcGIS Online organization to centralize user administration.

Set the profile visibility to private or organization

In ArcGIS Online, change the user’s profile visibility to Private or Organization.

Remove users who are not part of the ArcGIS Online organization

In ArcGIS Online, delete users who no longer belong to the organization.