Configure Passwordless Login
Community and helpdesk administrators can use the Passwordless Login page in AdminX to manage authentication factors and device configurations for a smooth onboarding experience.
Overview
Community and helpdesk administrators can use the Passwordless Login page in the AdminX interface to manage authentication factors and device configurations, ensuring a smooth onboarding experience.
From this page, administrators can:
Enabling QR Code Display on the Login Screen
Use this section to manage the QR code display on the sign-in page.
When the Passwordless Login Using 1Kosmos App slider is enabled, the QR code is displayed on the login screen. Users can then authenticate by scanning the QR code from the 1Kosmos Mobile App using a linked device, or by requesting a push notification on the linked device.
To display the QR code on the login page:
Push Notification Using the 1Kosmos App
Push notification can be used as one of the multi-factor authentication mechanisms to authenticate a sign-in request.
To strengthen security and protect users from MFA bombing attacks, push notification behavior can be enhanced through the Enable number challenge on all push notification requests setting in AdminX. This adds an extra layer of verification during push notification authentication.
Enabling Number Challenge
To enable the number challenge for push notifications:
How the Number Challenge Works
When the Enable number challenge on all push notification requests setting is on and a user initiates a push notification request on the login screen, the corresponding authentication request is delivered to their enrolled mobile device. On opening the request, the mobile screen displays three randomly generated numbers, while the login UI displays the correct challenge value. When the user taps the number on their mobile screen that matches the challenge value shown in the UI, authentication succeeds and the user is logged in to the tenant.
The table below summarizes how push notification behavior changes when the setting is enabled or disabled.
Interface on UI
Number challenge screen does not appear on the UI.
Number challenge screen appears on the UI.
Interface on mobile
Consent screen appears.
Number challenge screen appears.
User action
To approve the request, tap Yes, it's me. If the user taps Cancel Sign In, the login request is cancelled.
To approve the request, tap the matching challenge value on the mobile screen. If the user taps Cancel Sign In, the login request is cancelled.
Authentication Factors for the Mobile App
This section lets administrators configure the primary and fallback authentication factors used after the user scans the QR code or accepts a push notification on their mobile device. The primary factor is invoked first; if it fails or is not supported on the user's device, the fallback factor is used.
The primary and fallback authentication factors apply to both passwordless login methods: 1Kosmos Mobile App (QR) and Push Notification Login.
Primary authentication factor — the MFA method users must complete after scanning the QR code or accepting a push notification on their mobile device.
Fallback authentication factor — the same set of methods as the primary factor, used only if the primary method fails or is not supported on the user's device.
Configuring LiveID and Biometrics for Passwordless Login
This is the default MFA method. Users authenticate using their enrolled biometrics, such as fingerprint or Face ID.
PIN
Users authenticate by entering an 8-digit PIN. The PIN method is intended for situations where biometric scanners or cameras are not permitted by company policy, or for older devices that lack these features.
Managing Number of Devices for Passwordless Login
This section lets administrators define how users onboard their mobile devices and FIDO authenticators. Administrators can choose whether users self-onboard from the Request an Invite option on the sign-in page or from the My Profile page in AdminX.
Enabling Users to Self-Onboard Devices Using Email Invitations
When the Allow users to self onboard devices using email invitations option is enabled, users can onboard a device using the Request an Invite link on the AdminX sign-in page. Users receive an invitation link at their registered email address and open the link on their mobile device to complete onboarding.
To onboard a device:
Enabling Users to Self-Onboard Devices from the User's Profile Page
When the Allow users to self onboard devices from user's profile page option is enabled, users can link their mobile device directly from their profile page in AdminX.
To enroll a device from the Devices tab:
After linking, the enrolled device appears under the Devices tab.
Device Linking Preferences
Use this section to manage the number of devices allowed for passwordless login.
The following table describes the available device configurations:
Max number of devices linked to an account
Specify the number of devices a user can enroll.
Are users allowed to enroll new devices after max number of devices are enrolled?
Choose whether users can enroll additional devices after reaching the maximum. Available options: <br><br>• Yes, Cleanup Oldest Device — remove the account from the oldest device.<br>• No, Reject New Devices — prevent the user from enrolling additional devices once the maximum is reached.
Max number of accounts onboarded on single device
Specify the maximum number of accounts that can be onboarded on a single device from one community. This is useful when users need multiple accounts — for example, a basic user account for typical activities and a helpdesk administrator account for troubleshooting.
After configuring the settings, click Save.
Configuring Push Notification Rate Limiting
Community administrators can configure per-user rate limits for push notification requests to prevent excessive or abusive authentication attempts.
To configure rate limiting:
Rate Limiting Behavior
When the configured limit is reached:
Additional push notification requests are blocked.
The Send Push option becomes temporarily unavailable.
A countdown timer is displayed indicating when the next request can be made.
The restriction applies across sessions and browser tabs for the same user.
Applicable Scenarios
Push notification rate limiting applies to:
Login using push notification.
Step-up authentication flows using push verification.
What Happens After the Cooldown Period
Push notification requests are automatically re-enabled after the configured wait time.
The Send Push option becomes available again.
Users can resume normal authentication flows.
Last updated
Was this helpful?