I'd really be thinking hard about my cloud policies

A lot of social engineering attacks involve things like security question password reset, lost second factor reset, lost access to backup e-mail/phone, and things like that.

Don't most enterprise cloud offerings dispense with things like that, because users can visit a helpdesk in person?