VerifiedKnock Pass · Documentation

Microsoft Entra ID setup

Single sign-on (OpenID Connect) and help-desk permissions for VerifiedKnock Pass.

What VerifiedKnock Pass does with Microsoft Entra ID

• Sign in with Microsoft (SSO). Console staff can start sign-in with their work account. Protocol: OpenID Connect, authorization code flow with PKCE, Microsoft identity platform v2.0, multitenant (/organizations endpoint), confidential client. Scopes: openid profile.
• A security key is always required. After Microsoft sign-in, the person must also tap their enrolled FIDO2 security key, with PIN or fingerprint. Microsoft sign-in alone never opens the console. People who only use their security key can keep doing that.
• Account matching. VerifiedKnock matches people by the immutable Microsoft Entra tenant ID and object ID (tid + oid claims). Email address and UPN are never used to match.
• Help-desk actions (optional). After a branch supervisor (in person) and a separate help-desk agent each tap their own enrolled security key (or the employee taps their own enrolled key, as a secondary option), the agent can issue a one-time Temporary Access Pass or remove a lost authenticator in your tenant. This needs one-time admin consent to the application permissions below.

Supported: work or school accounts in any Microsoft Entra tenant. Not supported for the console: personal Microsoft accounts. User provisioning (SCIM) is not offered. VerifiedKnock is sold by subscription; Microsoft Entra ID licensing is your own. Temporary Access Pass availability depends on your Microsoft licensing and authentication-method policy.

VerifiedKnock does not check ID documents. Your organization decides how supervisors identify employees in person.

Roles you need

Step 1: Turn on Sign in with Microsoft for a staff member

1. Your VerifiedKnock admin invites the person. They enroll a FIDO2 security key during the invite.
2. The person signs in at pass.verifiedknock.com/platform/login with their security key, opens Security keys, and selects Link Microsoft account.
3. They sign in with their work account. Microsoft may ask them to consent to “Sign you in and read your profile”.
4. Next time: Sign in with Microsoft → work account → tap security key. Unlink any time from Security keys.

Someone signing in with Microsoft for the first time who has not been invited and linked is turned away with the code MS_NOT_LINKED. VerifiedKnock never creates console accounts from a Microsoft sign-in.

Who needs a FIDO2 security key

Only branch supervisors and help-desk agents need a FIDO2 security key (security keys are not included). Employees do not need one. Optional: an employee who already has a supervised-enrolled VerifiedKnock key (Platform → your organization → Employee enrollment) can tap it instead of the supervisor during help-desk recovery.

Only branch supervisors and help-desk agents need a FIDO2 security key (security keys are not included). Employees do not need one. Employees who already have a supervised-enrolled key can optionally tap it instead of the supervisor. If a supervisor or help-desk agent loses their key, they re-enroll at a supervised enrollment. An employee without a key is helped by a supervisor and a separate help-desk agent.

Requirement: only branch supervisors and help-desk agents need a FIDO2 security key (not included). Employees do not need one.

Step 2: Connect help-desk actions (admin consent)

1. In the VerifiedKnock console, open Help desk → Settings and select Connect Microsoft Entra ID.
2. A Privileged Role Administrator or Global Administrator reviews the permissions below and selects Accept.
3. The same admin signs in once more so VerifiedKnock can confirm the tenant that granted consent.
4. The console runs a health check. It reports the permissions present, whether they are the least-privilege set, and whether target screening (the two read permissions) is ready. Until it is, every help-desk action is refused with GRAPH_PERMISSION_MISSING.
5. Make sure branch supervisors and help-desk agents have enrolled FIDO2 keys (see above) before they handle recoveries. Employees do not need a key.
6. In Employee enrollment → Branches, assign at least one branch supervisor and assign your help-desk agents to HQ. Staff-verified recovery needs a branch supervisor plus a help-desk agent, two different people with two different keys, and cannot be used until a supervisor is assigned.
7. Make sure Temporary Access Pass is enabled for the users you want to support (Entra admin center → Authentication methods → Policies → Temporary Access Pass).

Permissions and why we need them

For help desk, VerifiedKnock Pass asks for five application permissions: three narrow write permissions to manage temporary access passes, passkeys, and Microsoft Authenticator methods, and two read-only permissions to screen the target account before every action. It cannot read mail, files, calendars or passwords, and it cannot change users, groups or roles.

VerifiedKnock enforces agent roles itself and refuses directly assigned admin, disabled and guest accounts. Before a verification is created, and again right before the action runs, VerifiedKnock resolves the UPN to the Entra object ID, refuses disabled and guest accounts, and refuses anyone with an active or eligible directory role (default: any role; your admin can narrow the list in Help desk → Settings). If a check cannot run, nothing happens. Actions are sent to Microsoft Graph by object ID, and a key enrolled for one object ID never authorizes another. The pass is shown once, on the verified caller's own screen. VerifiedKnock never stores or logs the pass, and the agent never sees it.

Why application (app-only) rather than delegated permissions? The action is authorized by the two-person security-key verification (supervisor plus agent, or the caller’s own key), not by the agent’s directory role. With delegated permissions every agent would need an Entra admin role such as Authentication Administrator, which is exactly the kind of standing privilege help-desk attackers target, and the checks would depend on who happens to be signed in. App-only lets VerifiedKnock run the same screening for every agent, keep agents out of Entra admin roles, and enforce its own agent roles, deny list and audit trail. VerifiedKnock only calls Graph after a verified Match. Your admin can withdraw consent at any time.

Earlier versions asked for the broader UserAuthenticationMethod.ReadWrite.All. If your tenant consented before this change, reconnect (step 2) to grant the narrower permissions and the two read permissions above. Then remove the old permission in Entra admin center → Enterprise applications → VerifiedKnock Pass → Permissions. Help-desk actions stay blocked until both read permissions are consented.

VerifiedKnock signs in to Microsoft as a confidential (server-side) client. It does not read user mail, files, passwords, or sign-in logs.

Test it

1. Create or pick a pilot user in a test tenant with a FIDO2 key enrolled in VerifiedKnock.
2. Link Microsoft (step 1), sign out, then sign in with Microsoft and tap the key. You should land in the console.
3. Try Sign in with Microsoft with an unlinked user. You should see MS_NOT_LINKED.
4. For help desk: run the health check in Help desk → Settings, then issue a Temporary Access Pass for the pilot user after a verified Match.

Disconnect or remove

• One person: Security keys → Unlink Microsoft.
• Help-desk actions: Help desk → Settings → Disconnect.
• Everything: Entra admin center → Enterprise applications → VerifiedKnock Pass → Properties → Delete. This removes consent and all permissions in your tenant.

Troubleshooting

Technical reference

Need help?

Email support@verifiedknock.com. Security reports: security@verifiedknock.com. More on the Support page. How we handle data: Privacy Policy and Terms of Service. Include your organization name, the time (with time zone), and the error code. Never send passwords, Temporary Access Passes, or recovery codes.