Microsoft Entra ID
Help desk account recovery for Microsoft Entra ID
Passwordless sign-in with FIDO2 keys and passkeys needs an equally controlled recovery process. VerifiedKnock adds two-person approval in front of every Microsoft Entra Temporary Access Pass, so passwordless account recovery in Entra ID is consistent, enforced by policy and fully recorded.
It works with your existing tenant and authentication-method policies. Your help desk gets a structured approval workflow; your security team gets the evidence.
How it works
Two recovery paths, each enforced by policy and recorded end to end.
Lost key or passkey: supervisor and HQ approval
- An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
- The employee confirms their own phone with a short read-back code, so the session is bound to the right device.
- A separate HQ help-desk agent reviews the request and approves with their own FIDO2 security key.
- Only after both approvals, VerifiedKnock requests a single-use Microsoft Entra Temporary Access Pass. It is short-lived and shown only on the employee’s phone; neither approver sees it.
- The employee registers a new security key or passkey. Every step is written to the audit trail.
Employee still has a registered key: dual tap
- The employee taps their own registered security key.
- An authorized help-desk agent taps their own security key.
- With both approvals recorded, your help desk carries out the one requested recovery action.
Why add approval in front of Temporary Access Pass
Temporary Access Pass is the standard way to let an Entra ID user register a new passwordless credential. Without a defined workflow, the decision to issue one often rests with a single agent. VerifiedKnock makes it a two-person decision, binds it to the employee’s own device, and keeps the pass out of the approvers’ hands.
Built for
Organizations where account recovery has to be controlled, consistent and reviewable, and where staff can meet employees in person at a branch or site.
- Banks and credit unions with branch networks and a central help desk.
- Healthcare organizations with clinical and administrative staff across multiple sites.
- Enterprises standardizing on FIDO2 security keys and passkeys.
- CISOs and IT and identity directors who own recovery policy.
- Help-desk and service-desk managers who run recovery day to day.
Controls and audit
Recovery policy is enforced by the product, not left to individual judgment.
- Two-person approval: every lost-key recovery needs two different people, each with their own FIDO2 key.
- Separation of duties: an administrator can be a designated branch supervisor, but never the HQ help-desk approver.
- No self-approval: nobody can approve their own recovery, administrators included.
- Administrator keys: one registered FIDO2 security key is required; a backup key is optional but strongly recommended.
- One-time credentials: the pass is short-lived, single-use and never shown to approvers.
- Audit trail: each approver, key, step and result is recorded, giving your team evidence for internal and compliance reviews.
Deployment
VerifiedKnock connects to your existing Microsoft Entra ID tenant through Microsoft Graph and uses Temporary Access Pass, which your tenant already supports. The Microsoft Entra ID setup guide lists every permission and why it is needed. There is no rip-and-replace: your sign-in policies, authentication methods and directory stay as they are.
Subscribe through Microsoft Marketplace or start with a pilot. Pricing is per protected user and published on the pricing page.
Questions
How does passwordless account recovery work in Entra ID with VerifiedKnock?
A branch supervisor confirms the employee in person and a separate HQ help-desk agent approves, each with their own FIDO2 key. VerifiedKnock then requests a single-use, short-lived Temporary Access Pass, shown only on the employee’s phone, so they can register a new key or passkey.
What permissions does VerifiedKnock need in Entra ID?
The Microsoft Entra ID setup guide lists each Microsoft Graph permission and why it is needed.
How does VerifiedKnock enforce separation of duties?
Every lost-key recovery needs two different approvers, each with their own FIDO2 key. An administrator can be a designated branch supervisor, but never the HQ help-desk approver, and nobody can approve their own recovery.
Does VerifiedKnock collect ID documents or selfies?
No. Your organization defines how supervisors confirm employees in person. VerifiedKnock records the approvals, each made with a registered FIDO2 security key.
How is VerifiedKnock priced and purchased?
Pricing is per protected user and listed on the pricing page. You can subscribe through Microsoft Marketplace or contact us to start a pilot.
Related
- Controlled, auditable help desk account recovery
- Okta help desk account recovery with two-person approval
- Lost passkey account recovery for your organization
- Help desk caller verification with FIDO2 security keys
- Help-desk recovery overview
- Pricing
- Microsoft Entra ID setup guide
- Okta setup guide
- Supervisor-approved Temporary Access Pass (Entra ID)
- Okta lost security key recovery
Bring controlled recovery to your help desk
Subscribe through Microsoft Marketplace, or book a pilot with our team.