Skip to main content

Configure Built-in passkey for an integration

Built-in passkey makes a device the user trusts their second factor. Once a device is trusted, the user normally signs in from it without another prompt, because XFA verifies the device in the background. The dashboard turns it on with Built-in Passkey.

This guide assumes you are an admin of your organization in XFA. If you do not have an account yet, you can sign up.

Built-in passkey is one of three MFA methods. To compare it with TOTP and passkeys, see MFA methods.

Enable Built-in passkey

  1. In the XFA Dashboard, go to Enforcement.
  2. Click New to create an integration, or Manage on an existing one.
  3. Under Multi-Factor Authentication, turn on Built-in Passkey.

Users who sign in through this integration now confirm their sign-in with a trusted device.

MFA is not available for OpenID Connect (OAuth 2.0) integrations, IdP applications or Discovery connections. MFA can be used with Agentless sign-in.

Options

These two options remain visible whether MFA is on or off:

OptionWhat it does
Auto-approve first deviceApproves the first device a user trusts without the email confirmation, so new users can start straight away.
Double Identity VerificationChecks identity again, including on trusted devices. The available verification method or automatic approval determines whether the user needs to act. It applies to Built-in passkey only and requires a plan that includes advanced MFA controls. Passkeys are always requested, whatever this setting.

Turn off MFA

When creating an integration, turning off the last enabled MFA method opens Disable Multi-Factor Authentication?. Choose Disable MFA or Keep MFA enabled. When editing an existing integration, save or discard the change using the unsaved-changes bar; no disable dialog appears.

What users see

First device

The first time a user signs in on a device, XFA asks whether to trust it. The user chooses Trust this device or Don't trust, and XFA verifies the device either way. Choosing Trust this device normally avoids another confirmation on later sign-ins. XFA may then approve the device automatically or send the user an email. They click the button in that email, go back to the sign-in page, and are signed in. With Auto-approve first device on, the email step is skipped.

Another device

When a user signs in on a new device after trusting one, XFA may ask them to confirm it from the device they already trust. They open the XFA app or extension on that device and click Allow, and the sign-in continues on the new device.

With Double Identity Verification on, XFA checks identity again even on a trusted device. The available method, or automatic approval, decides whether the user needs to act.

Reset a user's MFA

  • In Devices, open the People tab, open the actions menu next to the user and choose Manage MFA. Choose Reset all MFA to remove all their MFA methods, or Remove beside a method to remove only that registration. The user sets up any removed method again when needed.
  • On the Devices tab, open the device actions menu and choose Remove Built-in passkey, under MFA when that submenu is present. This removes Built-in passkey for that device only; other devices, TOTP and passkeys stay in place.