Help-desk recovery · Microsoft Entra ID and Okta
Get locked-out employees back in, with two people approving.
When an employee loses access to their security key or passkey, VerifiedKnock protects account recovery with two separate, hardware-backed approvals.
A branch supervisor verifies the employee in person and approves using their FIDO2 security key. A separate, authorized HQ help-desk agent approves using their own key.
Both approvals are required. VerifiedKnock then requests a Microsoft Entra Temporary Access Pass or Okta Temporary Access Code, released once on the employee's own screen to restore access and enroll a new credential.
Every step is recorded in the audit trail.
Phishing-resistant login deserves phishing-resistant recovery.
or email founders@verifiedknock.comHow a recovery works
- 1
Checked in person
The branch supervisor confirms the employee face to face and approves with their key.
- 2
Second approval
A separate HQ help-desk agent approves with their own key. A branch supervisor plus a help-desk agent: two different people, two different keys.
- 3
Back to work
A Microsoft Temporary Access Pass or Okta Temporary Access Code appears once, only on the employee’s screen. Everything is logged.
Help-desk recovery and supervised enrollment
A locked-out employee meets their branch supervisor. The supervisor and a separate help-desk agent each approve using their own hardware security keys. Once both approvals are verified, VerifiedKnock automatically requests a Microsoft Temporary Access Pass or an Okta Temporary Access Code.
Organizations can also supervise the enrollment of employees and customers, register hardware-backed credentials, and manage their authorization throughout the credential lifecycle.
VerifiedKnock Business
Simple, scalable pricing
- 1–10 branches
- $49 per branch/month
- 11–50 branches
- $25 per branch/month
- 51–399 branches
- $10 per branch/month
- 400+ branches
- Custom enterprise pricing. Contact us
Volume discounts automatically lower your per-branch rate.
Each rate applies to the branches within that tier.
Also available on Microsoft Marketplace
Includes two-person help-desk recovery, supervised employee and customer enrollment, security-key management, and audit trails.
- No per-employee fee
- A central help desk isn’t billed as a branch
- Works with your existing Microsoft Entra ID or Okta tenant
- Security keys not included
Customer verification at high volume: custom usage pricing. Contact us.
Questions
What happens when an employee is locked out?
The employee meets their branch supervisor. The supervisor checks them in person and approves with a hardware security key. A second authorized help-desk agent approves with their own key. After both approvals, VerifiedKnock requests a Microsoft Temporary Access Pass or an Okta Temporary Access Code, shown once on the employee’s own screen so they can enroll a new passkey. Every step is recorded in the audit trail.
Does VerifiedKnock check ID documents?
No. Your organization decides how supervisors identify employees in person. VerifiedKnock records the two approvals, each made with an enrolled hardware security key.
Which identity providers does it work with?
Microsoft Entra ID and Okta. It works with your existing tenant.
Does the employee need a security key?
No key is needed to be recovered. The supervisor and the help-desk agent each approve with their own hardware security key. The employee uses the one-time Temporary Access Pass or Temporary Access Code to enroll a new passkey.
How much does it cost?
VerifiedKnock Business is $49 per branch per month for 1–10 branches, $25 for 11–50, $10 for 51–399, and custom enterprise pricing for 400+ branches. Each rate applies to the branches within that tier. It includes two-person help-desk recovery, supervised employee and customer enrollment, security-key management, and audit trails. There is no per-employee fee. Security keys are purchased separately.
Ready to pilot?
Book a 30-minute call. We’ll walk through your use case and set up a pilot.