Fallback Authentication

Configure a secure fallback authentication method for Windows login so users can regain access with a Helpdesk-issued one-time passcode when their primary method fails.

---

Overview

When users sign in to Windows, authentication is typically performed using their primary authentication method. However, in certain situations, users may be unable to authenticate successfully. For example:

• Behavioral Authentication may fail due to changes in the user's typing patterns.
• A user may forget their PIN.

To prevent unnecessary workstation lockouts, 1Kosmos provides a configurable fallback authentication mechanism for Windows login. This feature allows administrators to define a secure secondary authentication method that users can use when the primary method fails.

In such cases, users can contact the Helpdesk to obtain a temporary one-time passcode (OTP). The OTP allows the user to securely sign in to Windows and reset one enrolled authentication factor, such as Behavioral Authentication or PIN.

The fallback authentication mechanism is currently supported only for users enrolled in Behavioral Authentication and PIN authentication methods. Users must have previously enrolled in one or both of these methods to use fallback authentication.

How It Works

Community Administrators can configure a fallback auth journey within the AdminX interface as part of the Windows MFA Fallback Authentication Journeys.

As part of this configuration:

• Passcodes are enabled as an authentication factor.
• Community Administrators, or users with the user.helpdesk-passcode.generate permission , can generate a passcode from a user's profile.
• The user can authenticate their Windows workstation using the passcode and then reset the failed authentication factor in the 1Kosmos Credential Provider before logging in.

The fallback authentication process consists of three key stages that enable secure account recovery for users locked out due to behavioral authentication failure:

• Setting up Fallback Authentication
• User login experience when fallback is triggered
• Generating passcodes

Step 1: Setting Up Fallback Authentication

This step involves enabling the Fallback Authentication Journeys tab in the AdminX interface and configuring the fallback authentication workflow.

Enabling the Display of Fallback Auth Journeys Tab on AdminX Interface

To display the Fallback Auth Journeys tab:

1

Log in

Log in to your tenant as a community administrator.

2

Open Windows MFA settings

Navigate to Applications > Windows MFA > Settings.

3

Go to Authentication Preferences

Go to the Authentication Preferences section.

4

Turn on Fallback Journeys

Turn the Fallback Journeys slider ON. By default, the slider is turned off.

5

Set the trigger threshold

In the Trigger fallback after number of attempts field that appears after turning the slider ON, specify the number of attempts after which the fallback journey is triggered once a user has failed the auth attempts that many times.

6

Save

Click Save.

Configuring Fallback Auth Journeys

Community administrators can use the Fallback Auth journeys tab to configure a fallback journey and define the authentication method to be used for that journey.

To configure a fallback auth journey:

1. Log in to your tenant as a community administrator.
2. Navigate to Applications > Windows MFA. The Windows MFA page is displayed.
3. Click the Fallback Auth journeys tab.
4. To add a new journey, click Add new fallback journey.

1. In the page that is displayed, provide the following details:

   a. Provide a descriptive name for the journey.

   b. Define Conditions from the following options.

   Condition	Operator	Description
   Groups	is one of	Select this option to apply the journey only to specific AD groups. You can choose from a list of predefined groups, and the journey will apply only if the AD group exactly matches one of those.
   Groups	is not one of	The journey applies to all other groups except for the ones mentioned.
   Groups	contains	Select this option if you want the journey to apply to any AD group whose name includes a specific keyword or phrase.
   Groups	does not contain	Select this option to apply the journey for all other groups that do not include the specified keyword or phrases.
   Username	is one of	Specify the list of users for whom this journey is applicable.
   Username	is not one of	The journey applies to all other users except for the ones mentioned.
   Username	contains	Select this option if you want the journey to apply to any user whose name includes a specific keyword or phrase.
   Username	does not contain	Select this option to apply the journey for all other usernames that do not include the specified keywords or phrases.
   Username	starts with	Select this option to apply the journey for usernames that begin with the specified characters or words.
   Username	does not start with	Select this option to apply the journey for all other usernames that do not begin with the specified characters or words.
   Username	ends with	Select this option to apply the journey for users whose names end with specified characters or words.
   Username	does not end with	Select this option to apply the journey for all other usernames that do not end with the specified characters or words.
   Machine Name	is one of	Specify the machine name to which this journey has to be applied.
   Machine Name	is not one of	The journey applies to all other machines except for the ones mentioned.

   c. Define the outcome for each condition. You can select the "MFA Required" action for a journey. The following table provides the supported authentication methods for the above actions:

   Authentication Method	Description
   Admin Passcode	Prompts users to enter a passcode to authenticate.

   d. Click Save.

   You can disable a fallback authentication journey by editing the journey and disabling the slider beside the journey name.

Editing Fallback Auth Journey

Community administrators can modify or update the fallback auth journey in the AdminX interface.

To modify the auth journey:

1

Log in

Log in to your tenant as a community administrator.

2

Open Windows MFA

Navigate to Applications > Windows MFA.

3

Find the journey

In the Fallback Auth Journeys page that is displayed, navigate to the journey that you want to modify.

4

Edit the journey

Under the Actions column, click the pencil icon in line with the row that you want to edit.

5

Save changes

Modify the required details and click Save.

6

Deleting Fallback Auth Journey

Community administrators can use the AdminX interface to delete a fallback auth journey.

To delete a fallback auth journey:

7

Log in

Log in to your tenant as a community administrator.

8

Open Windows MFA

Navigate to Applications > Windows MFA.

9

Find the journey

In the Fallback Auth Journeys page that is displayed, navigate to the journey that you want to delete.

10

Delete the journey

Click the Delete icon beside the journey that you want to delete. The auth journey is deleted.

Step 2: User Login Experience when Fallback is Triggered

This section describes the user's login flow when fallback authentication is triggered due to behavioral authentication failure. The following steps outline the screens displayed to the user and the actions required to proceed.

When behavioral authentication fails during Windows login, fallback authentication is triggered. Follow the steps below to complete the sign-in process.

Enter your username

1

On the Sign In – Enter your username screen, enter your username and press Enter.

2

Choose Behavior Auth

On the Sign In – Choose an authentication method screen, click Behavior Auth.

3

Enter the phrase

Enter the phrase displayed on the screen and press Enter.

4

Enter the PIN

Enter the PIN and press Enter.

5

Fallback is triggered

Based on the number of attempts configured in the AdminX interface (Trigger fallback after number of attempts field), if a user enters an incorrect PIN and exceeds the specified attempt limit, a Trouble Logging In? screen is displayed. This screen prompts the user to contact the Helpdesk to obtain a passcode.

6

Choose Helpdesk Code

Click the Helpdesk Code. The following screen is displayed. At this stage, reach out to your helpdesk admin to receive the code.

The following table outlines what happens when you click each link:

When you click...	The UI
Helpdesk code	Takes you to the new screen to enter the code provided by Helpdesk.
Return to all login options	Displays all the configured adaptive authentication journeys for that user.

7

Enter the bypass code

Enter the bypass code received from your helpdesk admin.

8

Login successful

Upon successful validation of the passcode, the Login successful message is displayed to the user.

9

Reset your MFA

The user is prompted to reset one of their authentication methods. The Reset your MFA screen is displayed only to users who:

• Have Behavioral Authentication and/or PIN authentication enabled in the configured authentication journey, and
• Have previously enrolled in those authentication methods.

10

Select the method to reset

On the Reset your MFA screen, click the authentication method that needs to be reset. In this scenario, select User PIN.

11

Complete the reset

After selecting User PIN, the Begin Setup screen appears. The user must enter a new PIN and click Submit to complete the reset process.

Upon successful setup, the user is logged into the workstation.

Step 3: Generating Passcodes

Community Administrators or users with the user.helpdesk-passcode.generate permission can generate a passcode for users who contact the Helpdesk after behavioral authentication fails during workstation login. The passcode is a randomly generated six-digit number. The administrator can specify how long the passcode remains valid.

To generate a passcode from the AdminX interface:

1

Log in

Log in to your tenant as a community administrator.

2

Open All Users

Navigate to Users > All Users.

3

Generate Passcode

Click Generate Passcode.

4

Set the expiry

In the Generate One-Time Passcode screen, specify the duration after which the passcode will expire.

The duration can be specified in either minutes or hours.

• Minimum duration: 1 minute
• Maximum duration: 24 hours
• Default duration: 10 minutes

5

Generate

Click Generate.

Event Logs

The following events are triggered as part of the Fallback Authentication workflow:

• E_FALLBACK_AUTH_CONFIGURED – Triggered when fallback authentication settings are updated from the Windows MFA Settings page, such as enabling or disabling the feature or modifying the configured attempt threshold.
• E_FALLBACK_JOURNEY_CREATED – Triggered when a new fallback authentication journey is created.
• E_FALLBACK_JOURNEY_MODIFIED – Triggered when an existing fallback authentication journey is modified.
• E_FALLBACK_JOURNEY_DELETED – Triggered when a configured fallback authentication journey is deleted.
• E_OTP_REQUESTED – Triggered when a request is made to generate a one-time passcode (OTP).
• E_OTP_GENERATED – Triggered when the OTP is successfully generated.
• E_OTP_VERIFIED – Triggered when the OTP verification process is completed, indicating whether the verification was successful or failed.