How are your Help Desks verifying the identity of end-users prior performing activities like password and MFA factor resets?

We don't have nor do we want self service password resets.
We require challenge question responses via in-person (preferred) or phone via their manager/supervisor.

Help Desk Teams are verifying the identity of end-users prior to performing activities like password and MFA resets via a few ways. Some utilize another form of 2FA or MFA as users are usually required to have a few ways of identity verification like something you know, something you have, or something you are. Self-Service Password Reset (SSPR) allows users to reset passwords on their own using predefined verification methods, which helps lower these help desk requests. We love conditional access policies to enforce verification steps based on the user’s location, device, or risk level. Verify explicitly by always using strong authentication methods and ensuring compliance before authorizing.

Challenge questions.