VerifiedKnock · Documentation

Supervisor-approved Temporary Access Pass for lost FIDO2 security keys in Microsoft Entra ID

When an employee loses their FIDO2 security key or passkey, they often cannot sign in at all. A Microsoft Entra Temporary Access Pass lets them sign in once and register a new key. VerifiedKnock makes sure two people approve before that pass is created: a branch supervisor who checks the employee in person, and a separate help-desk agent. Each approves with their own FIDO2 security key.

How the recovery works

The branch supervisor checks the employee in person. The employee meets an authorized branch supervisor. Your organization decides how the supervisor identifies the employee. The supervisor starts the request in VerifiedKnock and approves with their own FIDO2 security key.
The employee confirms their own phone. The employee scans a QR code with their own phone, in a browser that is not signed in to the VerifiedKnock console. The phone shows a 6-digit code. The employee reads it back to the supervisor, who enters it to confirm the right phone is connected. The code expires after 15 minutes and allows a limited number of tries.
A separate help-desk agent approves. An authorized HQ help-desk agent, a different person from the supervisor, reviews the request and approves with their own FIDO2 security key. Both approvals are required.
VerifiedKnock requests a short-lived pass. Only after both approvals, VerifiedKnock asks the identity provider for a single-use, short-lived Microsoft Entra Temporary Access Pass and delivers it only to the employee’s phone. Neither approver sees it.
The employee registers a new key. The employee uses the pass to sign in and register a new security key or passkey.
Everything is recorded. Each step, approver, key and result is written to the audit trail.

How this compares with other approaches

Microsoft Entra Account Recovery. The employee verifies themselves with a government ID and a liveness check through an identity verification provider, then receives a Temporary Access Pass. It suits fully remote recovery. VerifiedKnock instead relies on a supervisor who knows or can see the employee, plus a second approval, and does not check ID documents.
Build it yourself with access packages or Logic Apps. You can add manager approval and issue a Temporary Access Pass through Microsoft Graph. You then build and maintain the approval rules, delivery of the pass, phone confirmation and audit trail yourself. VerifiedKnock provides these as a ready workflow.

Setup

Connect your tenant using the Microsoft Entra ID setup guide, which lists the Microsoft Graph permissions and why each one is needed.

Questions

Does Microsoft Entra ID have a built-in supervisor approval step for a Temporary Access Pass?

An administrator with the right role can create a Temporary Access Pass. Adding an approval by a second person usually means building a workflow, for example with access packages or Logic Apps. VerifiedKnock provides that two-person approval as a ready workflow.

Who sees the Temporary Access Pass?

Only the employee, on their own phone. The supervisor and the help-desk agent never see it.

Is the Temporary Access Pass reusable?

No. VerifiedKnock requests a single-use, short-lived Temporary Access Pass after both approvals.

Does VerifiedKnock check ID documents?

No. The branch supervisor identifies the employee in person, using your organization’s own process. VerifiedKnock records the two approvals, each made with an enrolled FIDO2 security key.

What permissions does VerifiedKnock need in Entra ID?

See the Microsoft Entra ID setup guide for the exact Microsoft Graph permissions and why each one is needed.

Questions or a pilot: [email protected]. See also Help-desk account recovery.