Configure Built-in passkey for an Integration

Built-in passkey lets XFA use device posture as an extra authentication factor without adding unnecessary prompts for trusted devices. Configure it on an integration or application so XFA can verify the device quietly during sign-in when the policy allows it. With Double Identity Verification enabled, XFA checks identity again at each sign-in, even on a trusted device. The available method or automatic approval determines whether the user needs to act.

Note: This guide assumes that you have an account set up with XFA for your organization and you're an admin for that organization on XFA. If you do not have an account, you can create one at https://dashboard.xfa.tech/signup.

Note: MFA can be added to any type of integration, except for an integration of type OAuth2. This applies to all MFA methods.

To configure a second factor bound to a device, use Built-in passkey. Its device-bound factor can complete without user interaction when the sign-in permits it. XFA provides this second factor.

Enable Built-in passkey

Go to the XFA Dashboard and navigate to Enforcement. Click New to create a new integration, or Manage on an existing integration to add MFA to it.

Enable the switch next to Enable XFA Multi-Factor Authentication, users will from now on be prompted to authenticate with Built-in passkey when logging in using this specific integration.

User Experience

The user can add devices to their account upon first login on a device. The user can either choose Trust or Don't trust. XFA verifies the device in both cases. Choosing Trust normally avoids another confirmation on later sign-ins. With Double Identity Verification, XFA checks identity again even on a trusted device; the available method or automatic approval determines whether the user needs to act.

First Device

When the user logs in for the first time on a device, they are prompted to trust it. XFA may approve the device automatically or ask the user to confirm it by email. If an email arrives, clicking its button and returning to the login page completes authentication.

Consecutive Devices

When the user signs in on a new device after trusting another, XFA may ask them to confirm it. If approval is requested on an enrolled device, they can open the XFA App or extension there and click Allow to continue signing in.

Managing Users and Devices

As an admin, you can manage trusted MFA devices for users in the XFA Dashboard. Navigate to Devices, open the People tab and choose Reset MFA authentication from the actions menu next to the user. This removes all of the user's MFA, including TOTP and passkeys. On next login, the user will have the same experience as if it was a first device they were enrolling.

To remove only one device for a user, navigate to Devices and choose Reset 2FA from the actions menu next to the device you want to remove as a second factor.