Behavior Authentication

Users authenticate by typing a displayed phrase (typing biometrics) followed by a PIN. No mobile app or hardware key required. Supports offline authentication via cached PIN.

---

Overview

Behavioral Authentication is particularly useful in environments requiring complex passwords (14–16 characters for PCI DSS compliance). With Behavioral Authentication and PIN enrolled, users can log in without repeatedly typing long passwords.

Both factors are enrolled and used via the Windows Workstation MFA Agent.

Credential Provider

Both factors are enrolled and used via the Windows Workstation MFA Agent.

Admin Setup

Enabling Behavior Auth and PIN Enrollment

Both PIN Enrollment and Behavior Auth Enrollment are disabled by default and must be explicitly enabled before users can enroll or authenticate with this method.

1. In AdminX, navigate to Applications > Windows MFA > Settings > Enrollment Preferences.
2. Toggle PIN Enrollment to ON.
3. Toggle Behavior Auth Enrollment to ON.
4. Save the settings.

Users will not see enrollment prompts or Behavior Auth login options until both toggles are enabled.

Configuring the Authentication Journey

1. In AdminX, navigate to Applications > Windows MFA > Adaptive Auth Journeys.
2. Create a new journey or edit an existing one.
3. Under Authentication Method, select Behavior Auth & PIN.
4. Assign the journey to the target user group or machine policy.
5. Save and publish the journey.

---

AdminX

Behavior Authentication is now also supported for AdminX login. Administrators can configure it as an adaptive authentication method and enroll their typing pattern directly from their AdminX profile.

Admin Setup

Configuring Behavior Auth in Adaptive Authentication

1. Log in to AdminX as a community admin.
2. Navigate to Authentication > Adaptive Authentication.
3. Click Add new adaptive auth journey.
4. Enter a Journey Name and ensure the Enabled toggle is ON.
5. Set the Conditions as required (for example, restrict by application or username).
6. Under Decision, set Action to MFA Required.
7. From the authentication method list, select Behavior Auth & PIN, Prompts the user to log in with their typing pattern and PIN.
8. Click Save.

Enrolling Behavior Auth and PIN

Administrators enroll their typing pattern directly from their AdminX profile.

1. Navigate to My Profile > Login Options.
2. Click the Setup dropdown and select Typing Pattern.
3. On the Setup Behavior Authentication screen, click Continue to enroll.
4. On the Capture Typing Pattern screen, type the displayed phrase exactly as shown in the Your input field — type naturally, as the system captures your rhythm.
5. Complete all 5 attempts and click Finish enrollment.
6. The enrolled Typing Pattern appears under Login Options.

PIN enrollment is a separate step. If PIN is not yet enrolled, select Pin from the Setup dropdown and complete PIN enrollment before using Behavior Auth & PIN to log in.

Logging in to AdminX

1. On the AdminX Sign in screen, select the Username tab.
2. Enter your Corporate Username and click Next.
3. On the Capture Typing Pattern screen, type the displayed phrase exactly as shown in the Your input field and click Next.
4. On the Enter your PIN screen, enter your 4-digit PIN and click Submit.
5. You are signed in to the AdminX interface.

The typing pattern screen appears only if Behavior Auth & PIN is configured as the authentication method in the adaptive auth journey assigned to your account. If you are not prompted for a typing pattern, verify the journey configuration with your administrator.

Configuring Fallback Authentication (v2.2.0.0+)

Fallback authentication allows a helpdesk-generated passcode to be used when a user cannot complete Behavior Auth & PIN after repeated failures.

1

In AdminX, navigate to Applications > Windows MFA > Settings > Authentication Preferences.

2

Enable the Fallback Journeys slider.

3

Set the Trigger fallback after number of attempts value to the desired threshold.

4

Create or select a separate Adaptive Auth Journey with the Admin Passcode authentication method.

5

Assign this journey as the Fallback Auth Journey.

6

Save the settings.

To generate a helpdesk passcode for a specific user:

1

In AdminX, navigate to Users > All Users.

2

Locate the user and click the three-dot menu next to their name.

3

Select Generate Passcode.

4

Set the passcode expiry (range: 1 minute to 24 hours; default: 10 minutes).

5

Provide the generated passcode to the user via a secure out-of-band channel.

---

Enrollment

Enrollment is triggered automatically on the user's first login after Behavior Auth is enabled. Users cannot be pre-enrolled by an administrator.

1

The user completes their normal authentication flow (e.g., password + OTP) as usual.

2

After successful primary authentication, the enrollment prompt appears.

3

A phrase is displayed on screen. The user types the phrase the configured number of times. Each entry captures the user's natural typing rhythm and cadence. Enrollment is complete when the required number of samples have been accepted.

4

The user is prompted to create a PIN. PIN length and complexity requirements are determined by the organisation's policy configured in AdminX. The user enters the PIN twice to confirm.

5

Enrollment is saved to the user's profile.

Users can click Skip to bypass enrollment and log in normally. They will be prompted to enroll again on the next login attempt. Enrollment cannot be permanently skipped — the prompt recurs until enrollment is completed.

User Guide

Standard Login with Behavior Auth & PIN

1

At the Windows login screen, click the 1Kosmos tile.

2

If using the Other User tile, enter your username first.

3

Select Behavior Auth from the available authentication options.

4

A phrase is displayed on screen. Type the phrase naturally, do not alter your typing speed or style.

5

After the phrase is accepted, enter your PIN.

6

The Windows session unlocks and you are logged in.

Offline Login with Cached PIN

When the workstation has no network connectivity, the Credential Provider detects the offline state and presents available offline options.

1

At the Windows login screen, click the 1Kosmos tile.

2

The Credential Provider detects no connectivity and displays offline authentication options.

3

Select PIN.

4

Enter your PIN.

5

The Windows session unlocks and you are logged in.

Offline PIN authentication is limited to 3 attempts. After 3 failed attempts, the cached PIN is cleared and offline PIN login is no longer available until the device reconnects and the user re-authenticates online. Contact your helpdesk if the cached PIN has been cleared.

Fallback Login (Helpdesk Passcode)

1

After exceeding the configured number of failed Behavior Auth & PIN attempts, the Trouble Logging In? screen appears.

2

Click Helpdesk Code.

3

Contact your helpdesk and request a one-time passcode.

4

Enter the passcode provided by the helpdesk.

5

The Windows session unlocks and you are logged in.

6

Optionally, you will be prompted to reset your enrolled typing pattern and/or PIN after logging in via fallback.

Managing Enrolled Pattern and PIN

Users can view, modify, or delete their enrolled typing pattern and PIN via the AdminX self-service portal.

1

Log in to AdminX.

2

Navigate to My Profile > Login Options.

3

Select the Behavior Auth or PIN entry.

4

Choose to Modify or Delete the enrolled factor as required.

Deleting an enrolled factor will require re-enrollment at the next login attempt.

Best Practices

Typing Biometrics, Do's and Don'ts

Do	Don't
Type naturally, at your normal pace	Don't intentionally slow down or speed up while typing
Use the same device and keyboard you enrolled on	Don't frequently switch keyboards between enrollment and authentication
Type in lowercase as prompted	Don't type in uppercase or mix case unless instructed
Complete enrollment carefully, multiple samples improve accuracy	Don't rush through the enrollment phrase entries
Perform enrollment in a normal working environment	Don't let another person type on your behalf during enrollment or authentication

Troubleshooting

Issue	Likely Cause	Resolution
Typing pattern not recognised	User's typing style has changed; different keyboard used; typing too fast or too slow	Type naturally and at a consistent pace; ensure you are using the same keyboard as during enrollment; if repeated failures occur, proceed through the fallback flow and re-enroll
PIN forgotten	User cannot recall their PIN	Use the fallback authentication flow (Helpdesk Code) to log in, then reset the PIN via My Profile > Login Options in AdminX
Account locked after failed Behavior Auth attempts	Maximum failed attempts exceeded before fallback threshold triggered	Contact the helpdesk to unlock the account and obtain a fallback passcode
Offline PIN cleared after 3 failed attempts	Three consecutive incorrect PIN entries in offline mode	Reconnect the device to the network; log in online to re-establish the cached PIN
Enrollment prompt not appearing	Behavior Auth Enrollment or PIN Enrollment toggle is OFF in AdminX	Verify both toggles are enabled in Applications > Windows MFA > Settings > Enrollment Preferences
Fallback option not available	Fallback Journeys slider is OFF; fallback journey not configured	Enable the Fallback Journeys slider and assign a fallback journey with the Admin Passcode method in Authentication Preferences