Okta · Early access

Okta help desk account recovery with two-person approval

VerifiedKnock brings a controlled, auditable recovery workflow to Okta. Two people approve every lost-key recovery, each with their own FIDO2 key, before a single-use Okta Temporary Access Code is issued to the employee’s own device.

It works with your existing Okta Identity Engine org and authenticator policies. Okta support is in early access.

Try it from Microsoft Marketplace Book a pilot

How it works

Two recovery paths, each enforced by policy and recorded end to end.

Lost key or passkey: supervisor and HQ approval

An authorized branch supervisor confirms the employee in person, using your organization’s own process, and approves with their own FIDO2 security key.
The employee confirms their own phone with a short read-back code, so the session is bound to the right device.
A separate HQ help-desk agent reviews the request and approves with their own FIDO2 security key.
Only after both approvals, VerifiedKnock requests a single-use Okta Temporary Access Code. It is short-lived and shown only on the employee’s phone; neither approver sees it.
The employee registers a new security key or passkey. Every step is written to the audit trail.

Employee still has a registered key: dual tap

The employee taps their own registered security key.
An authorized help-desk agent taps their own security key.
With both approvals recorded, your help desk carries out the one requested recovery action.

Why add approval in front of Temporary Access Code

Temporary Access Code lets an Okta user enroll a new authenticator. VerifiedKnock ensures the decision to issue one is shared between two people, recorded in full, and delivered only to the employee, so your recovery policy is applied the same way every time.

Supported orgs: Okta Identity Engine with the Temporary Access Code authenticator turned on.

Built for

Organizations where account recovery has to be controlled, consistent and reviewable, and where staff can meet employees in person at a branch or site.

Banks and credit unions with branch networks and a central help desk.
Healthcare organizations with clinical and administrative staff across multiple sites.
Enterprises standardizing on FIDO2 security keys and passkeys.
CISOs and IT and identity directors who own recovery policy.
Help-desk and service-desk managers who run recovery day to day.

Controls and audit

Recovery policy is enforced by the product, not left to individual judgment.

Two-person approval: every lost-key recovery needs two different people, each with their own FIDO2 key.
Separation of duties: an administrator can be a designated branch supervisor, but never the HQ help-desk approver.
No self-approval: nobody can approve their own recovery, administrators included.
Administrator keys: one registered FIDO2 security key is required; a backup key is optional but strongly recommended.
One-time credentials: the pass is short-lived, single-use and never shown to approvers.
Audit trail: each approver, key, step and result is recorded, giving your team evidence for internal and compliance reviews.

Deployment

VerifiedKnock connects to your existing Okta org and uses the Okta Temporary Access Code authenticator. The Okta setup guide lists the scopes and settings. Okta support is in early access. There is no rip-and-replace: your sign-in policies, authentication methods and directory stay as they are.

Subscribe through Microsoft Marketplace or start with a pilot. Pricing is per protected user and published on the pricing page.

Questions

How does Okta help desk account recovery work with VerifiedKnock?

A branch supervisor confirms the employee in person and a separate HQ help-desk agent approves, each with their own FIDO2 key. VerifiedKnock then requests a single-use Okta Temporary Access Code, shown only on the employee’s phone.

Which Okta orgs are supported?

Okta Identity Engine orgs with the Temporary Access Code authenticator turned on. Okta support is in early access.

How does VerifiedKnock enforce separation of duties?

Every lost-key recovery needs two different approvers, each with their own FIDO2 key. An administrator can be a designated branch supervisor, but never the HQ help-desk approver, and nobody can approve their own recovery.

Does VerifiedKnock collect ID documents or selfies?

No. Your organization defines how supervisors confirm employees in person. VerifiedKnock records the approvals, each made with a registered FIDO2 security key.

How is VerifiedKnock priced and purchased?

Pricing is per protected user and listed on the pricing page. You can subscribe through Microsoft Marketplace or contact us to start a pilot.

Bring controlled recovery to your help desk

Subscribe through Microsoft Marketplace, or book a pilot with our team.