Configure Built-in passkey for an integration
Built-in passkey makes a device the user trusts their second factor. Once a device is trusted, the user normally signs in from it without another prompt, because XFA verifies the device in the background. The dashboard turns it on with Built-in Passkey.
This guide assumes you are an admin of your organization in XFA. If you do not have an account yet, you can sign up.
Built-in passkey is one of three MFA methods. To compare it with TOTP and passkeys, see MFA methods.
Enable Built-in passkey
- In the XFA Dashboard, go to Enforcement.
- Click New to create an integration, or Manage on an existing one.
- Under Multi-Factor Authentication, turn on Built-in Passkey.
Users who sign in through this integration now confirm their sign-in with a trusted device.
MFA is not available for OpenID Connect (OAuth 2.0) integrations, IdP applications or Discovery connections. MFA can be used with Agentless sign-in.
Options
These two options remain visible whether MFA is on or off:
| Option | What it does |
|---|---|
| Auto-approve first device | Approves the first device a user trusts without the email confirmation, so new users can start straight away. |
| Double Identity Verification | Checks identity again, including on trusted devices. The available verification method or automatic approval determines whether the user needs to act. It applies to Built-in passkey only and requires a plan that includes advanced MFA controls. Passkeys are always requested, whatever this setting. |
Turn off MFA
When creating an integration, turning off the last enabled MFA method opens Disable Multi-Factor Authentication?. Choose Disable MFA or Keep MFA enabled. When editing an existing integration, save or discard the change using the unsaved-changes bar; no disable dialog appears.
What users see
First device
The first time a user signs in on a device, XFA asks whether to trust it. The user chooses Trust this device or Don't trust, and XFA verifies the device either way. Choosing Trust this device normally avoids another confirmation on later sign-ins. XFA may then approve the device automatically or send the user an email. They click the button in that email, go back to the sign-in page, and are signed in. With Auto-approve first device on, the email step is skipped.
Another device
When a user signs in on a new device after trusting one, XFA may ask them to confirm it from the device they already trust. They open the XFA app or extension on that device and click Allow, and the sign-in continues on the new device.
With Double Identity Verification on, XFA checks identity again even on a trusted device. The available method, or automatic approval, decides whether the user needs to act.
Zero-touch built-in passkey
Zero-touch built-in passkey is in beta and is only available to organizations in the beta. If you do not see it under Built-in Passkey while Built-in Passkey is enabled, your organization does not have it yet: contact XFA to join the beta.
Zero-touch built-in passkey decides, per integration, whether users also confirm it's them on the device when Built-in passkey signs them in. The dashboard shows it under Built-in Passkey, only while Built-in Passkey is enabled on the integration and your organization is in the beta.
- On: the XFA app or agent signs users in on a trusted device without asking anything. This is how Built-in passkey has always worked.
- Off: on each sign-in, users confirm it's them on the device before XFA signs them in. This proves who is at the device, not only which device it is.
Defaults
- Integrations that existed before your organization joined the beta keep zero-touch on. Nothing changes for their users until you turn it off.
- Integrations created after your organization joined the beta start with zero-touch off.
What users see with zero-touch off
The sign-in page asks the user to confirm it's them on the device, and the device asks once per sign-in:
| Platform | How the user confirms |
|---|---|
| macOS | Touch ID or the Mac login password |
| Windows | Windows Hello (face, fingerprint or PIN), or the Windows account password when Windows Hello is not set up |
| Linux | Fingerprint, or the account password when no fingerprint is enrolled |
| iOS and Android | Face ID, Touch ID or fingerprint, or the device passcode |
A user who cancels is not signed in and can try again. The fingerprint, face or password never leaves the device; XFA only learns that the device confirmed the user. With Double Identity Verification on as well, both steps happen: the user first approves the sign-in on another device (a push to their phone, or an email), and the signing device then also asks them to confirm it's them before Built-in passkey signs them in.
Devices that cannot confirm the user
With zero-touch off, XFA refuses a sign-in from a device that has no way to confirm the user, and the sign-in page tells the user what to do:
- iOS and Android: set a passcode or screen lock.
- Windows: set up Windows Hello or a password for the account, and sign in on the computer itself rather than through a remote session.
- Linux: sign in from the desktop session. A tarball install or a per-user Nix install needs one setup step first, which the sign-in page shows: a command to run as root, or a change to the NixOS system configuration. The deb, rpm and Nix packages need no extra step.
- An older version of XFA: the user sees "Update XFA on this device to sign in." and updates XFA.
The user guide walks users through each case. If users cannot fix their device, turn Zero-touch built-in passkey back on for that integration. They then sign in without the prompt again.
Reset a user's MFA
- In Devices, open the People tab, open the actions menu next to the user and choose Manage MFA. Choose Reset all MFA to remove all their MFA methods, or Remove beside a method to remove only that registration. The user sets up any removed method again when needed.
- On the Devices tab, open the device actions menu and choose Remove Built-in passkey, under MFA when that submenu is present. This removes Built-in passkey for that device only; other devices, TOTP and passkeys stay in place.