FIDO2 help desk verification

Help desk caller verification with FIDO2 security keys

VerifiedKnock replaces knowledge questions and codes read over the phone with FIDO2 approvals your help desk can rely on. Every account change is verified with registered security keys and recorded in full.

When the employee has lost their key, verification moves to an in-person supervisor plus a separate HQ approver. When they still have it, a dual tap confirms the request.

Try it from Microsoft Marketplace Book a pilot

How it works

Two recovery paths, each enforced by policy and recorded end to end.

Lost key or passkey: supervisor and HQ approval

An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
The employee confirms their own phone with a short read-back code, so the session is bound to the right device.
A separate HQ help-desk agent reviews the request and approves with their own FIDO2 security key.
Only after both approvals, VerifiedKnock requests a single-use Microsoft Entra Temporary Access Pass or Okta Temporary Access Code. It is short-lived and shown only on the employee’s phone; neither approver sees it.
The employee registers a new security key or passkey. Every step is written to the audit trail.

Employee still has a registered key: dual tap

The employee taps their own registered security key.
An authorized help-desk agent taps their own security key.
With both approvals recorded, your help desk carries out the one requested recovery action.

Why FIDO2 for help desk verification

A FIDO2 approval is bound to the genuine service and to a specific registered key, so nothing secret is read aloud and every decision is attributable. Agents follow a structured workflow instead of judging a conversation, and your security team can review exactly who verified each change.

Built for

Organizations where account recovery has to be controlled, consistent and reviewable, and where staff can meet employees in person at a branch or site.

Banks and credit unions with branch networks and a central help desk.
Healthcare organizations with clinical and administrative staff across multiple sites.
Enterprises standardizing on FIDO2 security keys and passkeys.
CISOs and IT and identity directors who own recovery policy.
Help-desk and service-desk managers who run recovery day to day.

Controls and audit

Recovery policy is enforced by the product, not left to individual judgment.

Two-person approval: every lost-key recovery needs two different people, each with their own FIDO2 key.
Separation of duties: an administrator can be a designated branch supervisor, but never the HQ help-desk approver.
No self-approval: nobody can approve their own recovery, administrators included.
Administrator keys: one registered FIDO2 security key is required; a backup key is optional but strongly recommended.
One-time credentials: the pass is short-lived, single-use and never shown to approvers.
Audit trail: each approver, key, step and result is recorded, giving your team evidence for internal and compliance reviews.

Deployment

VerifiedKnock connects to your existing Microsoft Entra ID tenant (Temporary Access Pass) or Okta org (Temporary Access Code). Your identity provider stays the system of record. Okta support is in early access. There is no rip-and-replace: your sign-in policies, authentication methods and directory stay as they are.

Subscribe through Microsoft Marketplace or start with a pilot. Pricing is per protected user and published on the pricing page.

Questions

What is help desk caller verification?

It is how your help desk confirms that the person requesting an account change is the right employee. VerifiedKnock uses FIDO2 approvals: a dual tap when the employee still has their key, and supervisor plus HQ approval when the key is lost.

What is FIDO2 help desk verification?

Using FIDO2 security keys for verification and approval steps instead of knowledge questions or one-time codes. Each approver uses their own registered key, and every approval is recorded.

How does VerifiedKnock enforce separation of duties?

Every lost-key recovery needs two different approvers, each with their own FIDO2 key. An administrator can be a designated branch supervisor, but never the HQ help-desk approver, and nobody can approve their own recovery.

Does VerifiedKnock collect ID documents or selfies?

No. Your organization defines how supervisors confirm employees in person. VerifiedKnock records the approvals, each made with a registered FIDO2 security key.

How is VerifiedKnock priced and purchased?

Pricing is per protected user and listed on the pricing page. You can subscribe through Microsoft Marketplace or contact us to start a pilot.

Bring controlled recovery to your help desk

Subscribe through Microsoft Marketplace, or book a pilot with our team.