1Key Biometric

Users authenticate using a FIDO2 hardware security key. 1Kosmos supports both single-user keys and multi-user biometric keys (1Key Desktop, which supports up to 3 enrolled users per key).

---

Admin Setup

Configure the Journey for Standard FIDO Login

1

In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2

Create a new journey or edit an existing one.

3

Under Authentication Method, select FIDO.

4

Assign the journey to the target user group or machine policy.

5

Save and publish the journey.

Configure the Journey for Shared Account Login (CyberArk)

1

In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.

2

Create a new journey or edit an existing one.

3

Under Authentication Method, select FIDO for Shared Account Login.

4

Configure the CyberArk integration settings as required by your deployment.

5

Assign the journey to the target shared account user group.

6

Save and publish the journey.

Before any user can authenticate with a FIDO2 key or 1Key, the key must be enrolled in the 1Kosmos platform. See 1Key Enrollment Documentation for enrollment steps. Non-enrolled keys will not be recognised during authentication.

User Guide

Login with a Single-User FIDO2 Key

1

Plug the FIDO2 security key into a USB port on the workstation.

2

At the Windows login screen, click the 1Kosmos tile.

3

If using the Other User tile, enter your username first.

4

Click Security Key.

5

Place your enrolled finger on the key's fingerprint sensor.

• For biometric keys (such as 1Key), a PIN prompt is not presented, fingerprint is the sole authenticator on the key.

• For non-biometric FIDO2 keys, a PIN entry prompt appears. Enter the key PIN, then touch the key when it blinks.

6

The Windows session unlocks and you are logged in.

If fingerprint recognition fails after multiple attempts, clean the sensor surface with a dry cloth and retry. See Troubleshooting below for further guidance.

Login with a Multi-User Key / 1Key Desktop

The 1Key Desktop is a desk-mounted biometric key that supports up to 3 enrolled user profiles per device.

1

Approach the workstation, the 1Key Desktop sensor is mounted on or near the desk.

2

Long-press the sensor to cycle through and select your enrolled user profile.

3

When your profile indicator is active, place your finger on the sensor.

4

Authentication is processed and the Windows session unlocks.

If multiple users share the same workstation, ensure each user has enrolled their profile on the specific 1Key Desktop unit assigned to that workstation. Profile enrollment is device-specific.

Shared Account Login with 1Key (CyberArk Integration)

1

Plug the 1Key into a USB port or approach the 1Key Desktop unit.

2

At the Windows login screen, click the 1Kosmos tile.

3

Authenticate your primary identity using the 1Key (fingerprint, as described above).

4

A list of shared accounts you are authorised to access is displayed.

5

Select the target shared account from the list.

6

The Windows session launches under the selected shared account.

The list of authorised shared accounts is sourced from CyberArk based on your primary identity's permissions. If expected accounts do not appear, verify your CyberArk entitlements with your privileged access administrator.

Troubleshooting

Issue	Likely Cause	Resolution
Key not recognised by Windows	USB port issue; driver not loaded; key not enrolled	Try a different USB port; verify the Credential Provider service is running; confirm the key is enrolled in the 1Kosmos platform
Fingerprint not recognised	Sensor surface dirty; enrolled finger not placed correctly; skin condition affecting read	Clean the sensor with a dry, lint-free cloth; ensure the full enrolled finger pad covers the sensor; re-enroll the fingerprint if the issue persists
Wrong user profile selected on 1Key Desktop	Incorrect profile activated via long-press	Long-press the sensor again to cycle back to the correct user profile before placing the finger
Shared account not appearing after authentication	CyberArk entitlement not granted; CyberArk integration misconfigured; journey not set to Shared Account Login	Verify CyberArk account permissions for the authenticated user; confirm the journey uses the FIDO for Shared Account Login method; contact your PAM administrator
PIN prompted for biometric key	Key firmware or enrollment issue	Biometric 1Key keys should not prompt for PIN; re-enroll the fingerprint via the 1Key management tool; contact 1Kosmos support if the issue persists