> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Manage authenticators An authenticator helps protect an application from unauthorized access by requiring users to complete an authentication step, such as a password, OTP, or push approval, during sign-in. note If you are deciding which authenticators to use, start with the [Authenticator selection guide](/docs/authentication-and-security/manage-authenticators/authenticator-selection-guide.md). If you are planning password recovery, help desk recovery, user unlock, or first-time authenticator enrollment, start with [Account recovery and authenticator readiness](/docs/authentication-and-security/manage-authenticators/account-recovery-and-authenticator-readiness.md). ## User authenticators The following points describe how authenticators are assigned in IDaaS: - Users can be assigned multiple authenticators. - Users must have at least one authenticator to sign in to IDaaS. - Users can select OTP delivery by voice, email, or SMS when the corresponding contact details are registered in their profile. - Assigned tokens have a state of **Active** or **Inactive**. Only **Active** tokens can be used for authentication. - Resource rules determine which authenticators can be used to sign in to an application. - Users created locally in IDaaS or synchronized from Active Directory (AD) can be assigned authenticators automatically. note This section explains how to configure global settings on the **General** page and how to configure authenticator policies. To apply different settings for specific groups, use [Group policies](/docs/authentication-and-security/manage-group-policies.md). ## Push transaction queuing The push transaction queuing feature supports users who need to verify multiple transactions during the day and may need time to complete other steps before confirming each transaction. For example, bank loan officers can use this feature during the loan approval process. When enabled, IDaaS can send multiple transactions to a user's mobile soft token app and allow the user to respond within a configured time period. If the queue size set to `1`, only one transaction can be active at a time for a soft token identity. A new transaction overwrites the previous one. Additionally, transactions typically expire after a short time. 100% ### Example of queued transactions A loan officer at AnyBank is asked to approve about 15 loans a day. The approval is granted by responding to a transaction challenge sent to loan officer's mobile soft token identity being used for transaction queuing. The administrator configured the push transaction to expire after two days (**Push Transaction Lifetime**). To handle spikes in activity, the administrator also set the **Maximum Queued Transactions** to twice the typical daily transaction volume. As a result, the loan officer can have up to 30 transactions queued for this identity. When the queue reaches this limit, the system removes expired transactions first, or deletes the oldest transactions to make room for new ones. Ideally, the queue never reaches this limit, and the loan officer responds to each transaction before the system deletes it. For more information, see [Manage General settings](/docs/authentication-and-security/manage-authenticators/manage-general-settings.md). ## Assigning user authenticators To assign authenticators to users, see the following: - [Assign user authenticators](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/assign-user-authenticators.md) - [Bulk assign authenticators](/docs/perform-bulk-operations/bulk-assign-authenticators.md) For information about how users authenticate with applications, see [Applications and SSO](/docs/applications-and-sso.md). ## Topics in this section [📄️Selection guide Use this guide to compare Entrust Identity as a Service (IDaaS) authenticators, understand the strengths and limitations of each option, and choose where to use each authenticator in your authentication flows.](/docs/authentication-and-security/manage-authenticators/authenticator-selection-guide.md) [📄️Account recovery and readiness Use this guide to plan account recovery with the available IDaaS capabilities. Account recovery includes the following:](/docs/authentication-and-security/manage-authenticators/account-recovery-and-authenticator-readiness.md) [📄️Lockout behavior The authenticators allowed to access applications are set by the resource rules (see Create and manage resource rules). If a user enters an incorrect authentication response more times than the value set in the Lockout Count, the authenticator is locked and the user cannot access the application using that authenticator. See Manage General settings for more information about account lockout.](/docs/authentication-and-security/manage-authenticators/authenticator-lockout-behavior.md) [📄️General settings After you create a user, you must assign one or more authenticators to that user. The General settings control how authenticators work and whether the system automatically assigns authenticators when you create a user account.](/docs/authentication-and-security/manage-authenticators/manage-general-settings.md) [📄️Device fingerprint attributes Device fingerprint attributes help IDaaS recognize a browser or device when Device Fingerprint Required is selected in the machine authenticator settings. When the collected values match the stored fingerprint closely enough, the sign-in attempt is treated as lower risk. When key values change, IDaaS can assign more risk or treat the device as unfamiliar.](/docs/authentication-and-security/manage-authenticators/manage-device-fingerprint-attributes.md) [🗃Face biometrics 2 items](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md) [🗃Grid cards 6 items](/docs/authentication-and-security/manage-authenticators/manage-grid-cards.md) [🗃Hardware tokens 4 items](/docs/authentication-and-security/manage-authenticators/manage-hardware-tokens.md) [🗃Knowledge-based authentication 5 items](/docs/authentication-and-security/manage-authenticators/manage-knowledge-based-authenticators-kba.md) [📄️Machine authenticator settings Machine Authentication captures identifying information about the Web browser used to access an application. Resource rules can use this information during risk evaluation. When configured, IDaaS compares the browser's current Machine Authentication attributes with the attributes previously stored in the user's IDaaS account.](/docs/authentication-and-security/manage-authenticators/manage-machine-authenticator-settings.md) [🗃Magic Links 2 items](/docs/authentication-and-security/manage-authenticators/manage-magic-links.md) [📄️One-time password settings A one time password (OTP) authenticator is a random series of characters that are sent to a user's mobile device number or email address during authentication. If you are using WeChat or WhatsApp for OTP delivery, ensure that you have completed the prerequisites.](/docs/authentication-and-security/manage-authenticators/manage-one-time-passwords-otp.md) [🗃Pass-through 2 items](/docs/authentication-and-security/manage-authenticators/manage-pass-through-authenticators.md) [🗃Passkeys and FIDO2 2 items](/docs/authentication-and-security/manage-authenticators/manage-passkey-fido2-authenticators.md) [🗃Passwords 4 items](/docs/authentication-and-security/manage-authenticators/manage-password-authenticators.md) [🗃Password reset 1 item](/docs/authentication-and-security/manage-authenticators/manage-password-reset.md) [🗃Risk-based authentication 3 items](/docs/authentication-and-security/manage-authenticators/manage-risk-based-authenticator-settings.md) [🗃Smart credentials 7 items](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials.md) [🗃Soft tokens 9 items](/docs/authentication-and-security/manage-authenticators/manage-soft-token-authenticators.md) [🗃Temporary access codes 2 items](/docs/authentication-and-security/manage-authenticators/manage-temporary-access-codes.md) [🗃User certificates 1 item](/docs/authentication-and-security/manage-authenticators/manage-user-certificate-authenticators.md)