Skip to content
VerifiedKnock
Book a pilot

Secure Help-Desk Recovery with FIDO2 Hardware Keys

Phishing-resistant help-desk recovery for password resets, MFA resets, and locked-out passkeys — using independent FIDO2 approvals and privacy-preserving identity verification instead of ID scans or selfies.

This is phishing-resistant help-desk recovery for Microsoft Entra, with Okta in early access. Recovery authorization is independent and two-person, backed by hardware keys, without collecting identity documents or selfies.

When an employee loses their FIDO2 security key or passkey, an authorized branch supervisor verifies them in person. The supervisor and a separate HQ help-desk agent then each approve the recovery using their own FIDO2 security keys.

Both approvals are required. VerifiedKnock requests a Microsoft Entra Temporary Access Pass or Okta Temporary Access Code on the employee’s own screen, so they can enroll a replacement credential.

No ID documents, no selfies, and no SMS or security questions. This is a separate recovery credential for supervised account recovery, not everyday sign-in. It works with Microsoft Entra ID. Okta support is in early access.

Beyond account recovery, VerifiedKnock supports supervised enrollment for employees and customers, registration of hardware-backed credentials, and policy-based authorization management throughout the credential lifecycle.

Book a pilotRead the setup guide
or email [email protected]

Lost security key guides: Microsoft Entra Temporary Access Pass with supervisor approval · Okta lost security key recovery

Who this is for

Built for IAM and help-desk teams that need phishing-resistant, privacy-preserving identity verification before an MFA reset or account recovery.

Help desk and service desk teams that need to verify the caller before account recovery, an MFA reset, or a locked-out passkey.

It fits organizations on Microsoft Entra ID, or Okta in early access, where a branch supervisor can meet the employee in person and an HQ help-desk agent is the second approver. Both use their own FIDO2 security keys. The recovery pass is a supervised credential, separate from the employee’s everyday sign-in.

How a recovery works

  1. 1

    Checked in person

    The branch supervisor confirms the employee face to face and approves with their key.

  2. 2

    Second approval

    A separate HQ help-desk agent approves with their own key. A branch supervisor plus a help-desk agent: two different people, two different keys.

  3. 3

    Back to work

    A Microsoft Temporary Access Pass or Okta Temporary Access Code appears once, on the employee’s screen. Everything is logged.

Phishing-resistant recovery, without shared secrets

VerifiedKnock helps protect account recovery using independent, hardware-backed FIDO2 approvals instead of SMS codes, security questions, or identity-document uploads.

Caller verification applies when the employee still has a registered credential. For lost-key recovery, an authorized branch supervisor and an independent HQ help-desk agent must approve the recovery using their own registered security keys.

Each approval uses a cryptographic challenge bound to the legitimate service. Private keys remain protected by their authenticators, and no shared recovery secret needs to be disclosed.

The result is a supervised, auditable recovery process designed to reduce phishing and help-desk impersonation risks without collecting employee selfies or identity documents.

How this compares

Push-to-device MFA caller verification

Some service desk tools confirm a caller by sending a push or prompt to a phone or authenticator the caller already has. That checks a device in the caller’s possession.

VerifiedKnock uses staff-bound FIDO2 keys. A branch supervisor meets the employee in person and approves with their key. A separate HQ help-desk agent approves with a second key. A Microsoft Entra Temporary Access Pass or Okta Temporary Access Code then appears on the employee’s screen. It is a supervised recovery step, separate from everyday sign-in.

ID and selfie proofing

Some products verify a person by scanning a government ID and taking a selfie.

VerifiedKnock does not scan ID documents or take selfies, and it does not use SMS or security questions. The branch supervisor identifies the employee in person, using your organization’s process. VerifiedKnock records the two FIDO2 approvals and the audit trail.

VerifiedKnock Business

Pricing

Lost-key recovery is priced per protected user. A branch supervisor and a separate help-desk agent each approve with their own FIDO2 key, and a one-time pass appears on the employee’s screen.

Standard Protection
$1.50/user/month
High-Risk Protection
$3/user/month

High-risk protection is for roles such as admins, finance and payment approvers, and executives. Supervisors and help-desk agents may be high-risk.

$300 monthly minimum

  • Recovery attempts are unlimited, with no overage fees
  • Priced on protected users eligible for recovery, not enrolled key count

Deployment

One-Time Implementation & Onboarding

$1,000–$2,500

A range, scaled to deployment size. This covers onboarding services, not account activation.

  • Microsoft Entra or Okta integration
  • Branch and supervisor configuration
  • Administrator training
  • A supervised go-live

Annual commitment. The implementation fee is waived with annual prepayment on contracts of $10,000 or more per year.

  • Works with your existing Microsoft Entra ID tenant. Okta support is in early access.
  • Security keys not included

Also available on Microsoft Marketplace

Customer verification at high volume: custom usage pricing. Contact us.

Contact us for enterprise pricing and deployment planningWatch a recoveryBook a pilotSee all pricing →

Questions

What is help desk identity verification?

VerifiedKnock provides phishing-resistant help-desk identity verification before password resets, FIDO2 MFA resets, and locked-out passkey recovery for Microsoft Entra, with Okta in early access. A branch supervisor checks the employee in person and approves with a FIDO2 security key. A separate HQ help-desk agent approves with their own key. After both approvals, a Microsoft Entra Temporary Access Pass or an Okta Temporary Access Code appears on the employee’s screen so they can enroll a replacement credential. VerifiedKnock does not scan ID documents or take selfies, and it does not use SMS or security questions.

What happens when an employee is locked out?

Help desk identity verification starts with the employee and their branch supervisor. The supervisor checks them in person and approves with a hardware security key. A second authorized help-desk agent approves with their own key. After both approvals, VerifiedKnock requests a Microsoft Temporary Access Pass or an Okta Temporary Access Code, shown once on the employee’s own screen so they can enroll a new passkey. Every step is recorded in the audit trail.

Does VerifiedKnock check ID documents?

No. VerifiedKnock does not scan ID documents or take selfies. Your organization decides how supervisors identify employees in person. VerifiedKnock records the two approvals, each made with an enrolled hardware security key.

Which identity providers does it work with?

Microsoft Entra ID, and Okta in early access. It works with your existing tenant.

Does the employee need a security key?

No key is needed to be recovered. The supervisor and the help-desk agent each approve with their own hardware security key. The employee uses the one-time Temporary Access Pass or Temporary Access Code to enroll a new passkey.

How much does it cost?

Standard Protection: $1.50/user/month. High-Risk Protection: $3/user/month. High-risk protection is for roles such as admins, finance and payment approvers, and executives. Supervisors and help-desk agents may be high-risk. $300 monthly minimum. One-Time Implementation & Onboarding: $1,000–$2,500. A range, scaled to deployment size. This covers onboarding services, not account activation: Microsoft Entra or Okta integration, branch and supervisor configuration, administrator training, and a supervised go-live. The implementation fee is waived with annual prepayment on contracts of $10,000 or more per year. Recovery attempts are unlimited, with no overage fees. Priced on protected users eligible for recovery, not enrolled key count. Contact us for enterprise pricing and deployment planning. It includes two-person help-desk recovery, supervised employee and customer enrollment, security-key management, and audit trails. Security keys are purchased separately.

Ready to pilot?

Book a 30-minute call. We’ll walk through your use case and set up a pilot.

Book a 30-min callor email [email protected]