> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/passwordless-for-web-apps/use-cases/in-flight-enrollment-for-eam-behavior-auth-+-pin.md).

# In-Flight Enrollment for EAM (Behavior Auth + PIN)

***

Frontline workers who are pre-authenticated by an external identity provider (for example, Entra ID) and redirected to 1Kosmos for a second factor can now enroll Behavior Auth (typing pattern) and set a PIN during login—no personal device required. Previously, a pre-authenticated user who had no enrolled second factor was denied access with no way forward. Now the user enrolls on the spot, that enrollment satisfies the authentication requirement, and the user is redirected back to the application without a separate login step.

This is aimed at frontline-worker environments where users are not allowed to carry personal devices to their workstations, so phone-dependent factors (OTP, Push, QR) are not practical.

### Prerequisites

* Behavior Auth for web apps is enabled at the community level.
* An EAM OIDC application is configured for the community.
* Community Administrator access to the AdminX console.

### Configure the Authentication Method

The authentication method lets the EAM OIDC application both verify enrolled users and enroll unenrolled users in-flight.

1. In AdminX, open the EAM **OIDC application**.
2. Open its **Adaptive Auth Journey** configuration.
3. Under **Authentication Method**, select **OIDC ID Token & Behavior Auth**.
4. Save the configuration.

The **OIDC ID Token & Behavior Auth** option only appears when Behavior Auth for web apps is enabled for the community. All existing EAM authentication methods (OTP, Push, QR Code, FIDO) remain available and unchanged.

### Enrollment Flow

When a pre-authenticated user reaches the second factor without the required factors, they enroll in-flight via **Setup MFA → Setup Behavior Auth**. The steps adapt to what the user already has:

**No factors enrolled (neither Behavior Auth nor PIN):**

1. User enrolls their typing pattern - they are shown a phrase and must type it exactly.
2. User sets a PIN.
3. Access is granted and the user is redirected back to the application.

**Behavior Auth enrolled, PIN not set:**

1. Typing-pattern enrollment is skipped.
2. User sets a PIN.
3. Access is granted.

**PIN set, Behavior Auth not enrolled:**

1. User enrolls their typing pattern.
2. PIN setup is skipped.
3. Access is granted.

Enrollment counts as authentication, so the user is not asked to authenticate again after enrolling.

### Authentication Flow

Once enrolled, a returning user is pre-authenticated by the external identity provider and redirected to 1Kosmos for the second factor. The user verifies their typing pattern and enters their PIN, and is redirected back to the application.

### Notes and limitations

* In-flight enrollment happens only in the EAM pre-authenticated context. It is not available in non-EAM flows.
* This capability currently supports enrollment of **Behavior Auth and PIN** only.
* Existing EAM authentication methods (OTP, Push, QR Code, FIDO) continue to work as before.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/authentication/passwordless-for-web-apps/use-cases/in-flight-enrollment-for-eam-behavior-auth-+-pin.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.