Help desk verification
Stop help-desk social engineering and impersonation
VerifiedKnock is help desk verification for the moment a password or an MFA method has to change. A registered FIDO2 hardware key approves the request before your help desk issues a reset.
The lost-key path comes first. That is the request a caller can make without holding a key, and it is where help desk impersonation usually starts. The goal is to stop help desk impersonation before a credential is issued.
Help desk social engineering prevention
An attacker can call the help desk, claim to be an employee, and ask for a password reset or an MFA reset. A familiar name, an employee number, or a deepfake voice or video is not proof of who is calling. Answers to knowledge questions are often already known.
Help desk vishing prevention has the same limit: a voice on the phone is not a credential. The reset should not depend on whether the caller sounds right, or on how urgent the request feels. The help desk follows a supervised check instead.
How FIDO2 help desk identity verification works
VerifiedKnock puts supervised FIDO2 hardware-key verification in front of any reset. Two paths cover the calls your help desk already takes. The lost-key path is first.
Lost key: a branch supervisor and a different agent
- An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
- The employee opens the pickup link on their own device and confirms it with a short read-back code.
- A different person, the HQ help-desk agent, reviews the request and approves with their own FIDO2 security key. The supervisor is never that agent.
- Only after both approvals, VerifiedKnock requests a short-lived Microsoft Entra Temporary Access Pass or a single-use Okta Temporary Access Code, a one-time pass. It is shown only on the employee’s device. Neither approver sees it.
- The employee uses that pass to register a new passkey or security key.
Employee still has a key: two taps
- The employee taps their registered FIDO2 security key.
- The help-desk agent taps their own key.
- With both taps recorded, the help desk carries out the one requested action. That is a secure help desk password reset, or MFA reset verification, limited to the action that was approved.
Works with Microsoft Entra ID and Okta
VerifiedKnock connects to the identity provider you already run. Microsoft Entra ID uses a Temporary Access Pass. Okta uses a one-time Temporary Access Code. Okta support is in early access.
Your directory, sign-in policies, and authentication methods stay in place. VerifiedKnock does not replace them. It adds FIDO2 help desk identity verification in front of the reset your provider already knows how to issue.
Standard Protection is $1.50/user/month. High-Risk Protection is $3/user/month. Recovery attempts are unlimited, with no overage fees. Pricing is per protected user.
See help-desk recovery pricing
Administrator accounts and the audit log
VerifiedKnock refuses recovery for an account with a directly assigned administrative role in Microsoft Entra ID or Okta, and for an organization owner or admin. Those accounts stay on your privileged-access process.
Nobody approves their own recovery. An administrator can be a designated branch supervisor, but never the HQ help-desk approver. The one-time pass is short-lived and single-use, and it is never shown to the approvers.
Each approver, the key they used, the step, and the result is written to the audit log in order. A later review can see who approved the reset and what was issued.
Questions
What is help desk verification?
Help desk verification is how your service desk confirms an employee before a password reset, an MFA reset, or enrollment of a new passkey. VerifiedKnock requires a supervised FIDO2 hardware-key approval before that change. It does not use knowledge questions, SMS codes, ID scans, or selfies.
How does this support help desk social engineering prevention?
The reset does not depend on what the caller says, or on a voice or video that sounds like the employee. A registered FIDO2 key has to approve the request. When the employee’s key is lost, a branch supervisor and a different HQ help-desk agent each approve with their own keys before a one-time pass is issued.
What happens in MFA reset verification when the security key is lost?
A branch supervisor confirms the employee in person and approves with their own FIDO2 key. A different HQ help-desk agent approves with a second key. VerifiedKnock then requests a short-lived Microsoft Entra Temporary Access Pass or a single-use Okta Temporary Access Code, shown only on the employee’s device, so they can register a new passkey or security key.
What is a secure help desk password reset when the employee still has a key?
The employee taps their registered FIDO2 security key and the help-desk agent taps theirs. Both taps are recorded before the help desk performs the one requested reset.
Does VerifiedKnock work with Microsoft Entra ID and Okta?
Yes. It works with Microsoft Entra ID using Temporary Access Pass, and with Okta using a one-time Temporary Access Code. Okta support is in early access. Your identity provider stays the system of record.
Can the help desk reset an administrator account?
No. VerifiedKnock refuses recovery for accounts with a directly assigned administrative role, and for organization owners and admins. Those accounts stay on your privileged-access process.
What does the audit log contain?
Each approval, the key used, the step, and the result, written in order. Your team can review who approved a reset and what was issued. Neither approver sees the one-time pass.
Put a supervised check in front of the reset
Book a pilot, watch the demo, or review pricing.