Help desk account recovery

Controlled, auditable help desk account recovery

VerifiedKnock gives your help desk a single, policy-enforced process for restoring access when employees lose a security key or passkey. Two people approve every lost-key recovery, each with their own FIDO2 key, and the employee receives a one-time credential from your existing identity provider.

The result is consistent recovery across every branch and site, a complete record for your security and compliance teams, and fewer judgment calls for your help-desk staff.

Try it from Microsoft Marketplace Book a pilot

How it works

Two recovery paths, each enforced by policy and recorded end to end.

Lost key or passkey: supervisor and HQ approval

An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
The employee confirms their own phone with a short read-back code, so the session is bound to the right device.
A separate HQ help-desk agent reviews the request and approves with their own FIDO2 security key.
Only after both approvals, VerifiedKnock requests a single-use Microsoft Entra Temporary Access Pass or Okta Temporary Access Code. It is short-lived and shown only on the employee’s phone; neither approver sees it.
The employee registers a new security key or passkey. Every step is written to the audit trail.

Employee still has a registered key: dual tap

The employee taps their own registered security key.
An authorized help-desk agent taps their own security key.
With both approvals recorded, your help desk carries out the one requested recovery action.

Business outcomes

Consistent recovery: one documented process across every branch, site and help-desk shift.
Lower reset risk: no single person can restore access alone.
Lighter help-desk workload: agents approve a structured request instead of running an open-ended conversation.
Review-ready evidence: every recovery produces a clear record of who approved, with which key, and when.

Built for

Organizations where account recovery has to be controlled, consistent and reviewable, and where staff can meet employees in person at a branch or site.

Banks and credit unions with branch networks and a central help desk.
Healthcare organizations with clinical and administrative staff across multiple sites.
Enterprises standardizing on FIDO2 security keys and passkeys.
CISOs and IT and identity directors who own recovery policy.
Help-desk and service-desk managers who run recovery day to day.

Controls and audit

Recovery policy is enforced by the product, not left to individual judgment.

Two-person approval: every lost-key recovery needs two different people, each with their own FIDO2 key.
Separation of duties: an administrator can be a designated branch supervisor, but never the HQ help-desk approver.
No self-approval: nobody can approve their own recovery, administrators included.
Administrator keys: one registered FIDO2 security key is required; a backup key is optional but strongly recommended.
One-time credentials: the pass is short-lived, single-use and never shown to approvers.
Audit trail: each approver, key, step and result is recorded, giving your team evidence for internal and compliance reviews.

Deployment

VerifiedKnock connects to your existing Microsoft Entra ID tenant (Temporary Access Pass) or Okta org (Temporary Access Code). Your identity provider stays the system of record. Okta support is in early access. There is no rip-and-replace: your sign-in policies, authentication methods and directory stay as they are.

Subscribe through Microsoft Marketplace or start with a pilot. Pricing is per protected user and published on the pricing page.

Questions

What is help desk account recovery?

It is the process your help desk uses to restore an employee’s access when they cannot sign in, most often after losing a security key or passkey. VerifiedKnock makes that process two-person approved, policy enforced and fully audited.

Which identity providers are supported?

Microsoft Entra ID, using Temporary Access Pass, and Okta, using Temporary Access Code. Okta support is in early access.

How does VerifiedKnock enforce separation of duties?

Every lost-key recovery needs two different approvers, each with their own FIDO2 key. An administrator can be a designated branch supervisor, but never the HQ help-desk approver, and nobody can approve their own recovery.

Does VerifiedKnock collect ID documents or selfies?

No. Your organization defines how supervisors confirm employees in person. VerifiedKnock records the approvals, each made with a registered FIDO2 security key.

How is VerifiedKnock priced and purchased?

Pricing is per protected user and listed on the pricing page. You can subscribe through Microsoft Marketplace or contact us to start a pilot.

Bring controlled recovery to your help desk

Subscribe through Microsoft Marketplace, or book a pilot with our team.