Lost passkey account recovery

Lost passkey account recovery for your organization

As your organization moves to passkeys and FIDO2 security keys, lost credentials become a routine help-desk request. VerifiedKnock turns lost passkey account recovery into a defined, two-person approved process that your help desk can run the same way every time.

Employees get back to work with a one-time credential from Microsoft Entra ID or Okta. Your security team gets a complete record of each recovery.

Try it from Microsoft Marketplace Book a pilot

How it works

Two recovery paths, each enforced by policy and recorded end to end.

Lost key or passkey: supervisor and HQ approval

An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
The employee confirms their own phone with a short read-back code, so the session is bound to the right device.
A separate HQ help-desk agent reviews the request and approves with their own FIDO2 security key.
Only after both approvals, VerifiedKnock requests a single-use Microsoft Entra Temporary Access Pass or Okta Temporary Access Code. It is short-lived and shown only on the employee’s phone; neither approver sees it.
The employee registers a new security key or passkey. Every step is written to the audit trail.

Employee still has a registered key: dual tap

The employee taps their own registered security key.
An authorized help-desk agent taps their own security key.
With both approvals recorded, your help desk carries out the one requested recovery action.

Planning for lost credentials

A clear recovery path is part of any passkey rollout. Registering backup keys reduces disruption, and VerifiedKnock covers the cases where no backup is available: the employee needs no key of their own to be recovered, and no ID documents or selfies are collected.

Built for

Organizations where account recovery has to be controlled, consistent and reviewable, and where staff can meet employees in person at a branch or site.

Banks and credit unions with branch networks and a central help desk.
Healthcare organizations with clinical and administrative staff across multiple sites.
Enterprises standardizing on FIDO2 security keys and passkeys.
CISOs and IT and identity directors who own recovery policy.
Help-desk and service-desk managers who run recovery day to day.

Controls and audit

Recovery policy is enforced by the product, not left to individual judgment.

Two-person approval: every lost-key recovery needs two different people, each with their own FIDO2 key.
Separation of duties: an administrator can be a designated branch supervisor, but never the HQ help-desk approver.
No self-approval: nobody can approve their own recovery, administrators included.
Administrator keys: one registered FIDO2 security key is required; a backup key is optional but strongly recommended.
One-time credentials: the pass is short-lived, single-use and never shown to approvers.
Audit trail: each approver, key, step and result is recorded, giving your team evidence for internal and compliance reviews.

Deployment

VerifiedKnock connects to your existing Microsoft Entra ID tenant (Temporary Access Pass) or Okta org (Temporary Access Code). Your identity provider stays the system of record. Okta support is in early access. There is no rip-and-replace: your sign-in policies, authentication methods and directory stay as they are.

Subscribe through Microsoft Marketplace or start with a pilot. Pricing is per protected user and published on the pricing page.

Questions

How should an organization handle lost passkeys?

With a defined recovery process. In VerifiedKnock, a branch supervisor confirms the employee in person, a separate HQ help-desk agent approves, and a one-time credential from Entra ID or Okta lets the employee register a new passkey or security key.

Does the employee need their old passkey to be recovered?

No. The two approvers each use their own FIDO2 key. The employee only needs their phone to receive the one-time credential.

How does VerifiedKnock enforce separation of duties?

Every lost-key recovery needs two different approvers, each with their own FIDO2 key. An administrator can be a designated branch supervisor, but never the HQ help-desk approver, and nobody can approve their own recovery.

Does VerifiedKnock collect ID documents or selfies?

No. Your organization defines how supervisors confirm employees in person. VerifiedKnock records the approvals, each made with a registered FIDO2 security key.

How is VerifiedKnock priced and purchased?

Pricing is per protected user and listed on the pricing page. You can subscribe through Microsoft Marketplace or contact us to start a pilot.

Bring controlled recovery to your help desk

Subscribe through Microsoft Marketplace, or book a pilot with our team.