Sign-in methods for administrators

Platform › Users: which sign-in methods your company’s people may use, whether a second step is asked always, how long a device stays trusted, each person’s methods, and Reset sign-in methods. Passkeys must first be enabled for the deployment by its operator.

The company’s policy

1. Open Platform › Users. The figures above the list count Second step asked, Authenticator app, Passkeys, Device biometrics, PIN set and Flagged keys.
2. Press Sign-in method policy.
3. Tick the methods allowed: Authenticator app; Passkeys (synced passkeys and security keys); Device biometrics (Windows Hello, Touch ID / Face ID, fingerprint); A PIN as the second step on a trusted device; Sign in with a passkey alone, without a password. All are on by default.
4. Ask for a second step: Where this installation asks (every cloud deployment) or Always, for every password sign-in.
5. A trusted device stays trusted for (days): 1 to 90, 30 by default. Save. Every change is audited.

Each person

• The Sign-in methods column shows App, passkeys, device, PIN or PIN locked, trusted devices, and flagged key for a passkey refused because it may have been copied.
• Reset sign-in methods (for a lost phone or device) removes the authenticator app, recovery codes, passkeys, device biometrics, PIN and trusted devices, signs them out, and they set up a second step at their next sign-in. Check it really is them first.
• Resetting a portal user’s second step removes their portal passkeys too.
• Passkey use, PIN lock-outs, trusted devices and resets are in the audit trail, which cannot be switched off for them.

For the operator: enabling passkeys on a deployment

On a cloud deployment passkeys work only from the web addresses the operator lists. Until then the sign-in page shows no passkey button and Personalize says “Passkeys are not configured on this installation (set TRANXACT_WEBAUTHN_ORIGINS)”.

• Set TRANXACT_WEBAUTHN_ORIGINS to the addresses people open, comma-separated, for example https://erp.example.com. One leading wildcard serves tenant subdomains (https://*.access.example.com).
• Leave TRANXACT_WEBAUTHN_RP_ID unset in normal use: each host then keeps its own passkeys, and one tenant’s passkey is never offered on another’s page.
• Without the setting, the deployment’s configured public address is used if there is one.