> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Step B: Set up a Face Biometric authenticator

To use Face Biometrics with IDaaS for either registration or authentication, you need to create a workflow in Entrust Identity Verification and copy the workflow ID into IDaaS. Depending on your infrastructure, you create a workflow based on the following requirements:

- **Local storage.** Face biometrics are stored on the user's device. In this configuration, the user data is not stored in Entrust Identity Verification and can be deleted after registration.
  - Recommended for environments that prioritize user control and privacy by limiting data storage to devices.
  - Works well for mobile-first scenarios.
- **IDaaS storage.** Similar to local storage except the Face biometrics are stored in IDaaS instead of on the user's device. In this configuration, the user data is stored in IDaaS and can be deleted after registration.
  - This option provides more flexibility for users to use their Face Biometric across multiple devices.

## Step 1: Create the required workflows in Entrust Identity Verification

The following table lists the Entrust Identity Verification registration and authentication templates required for each storage solution. Use the Entrust Identity Verification documentation to help you build the workflows and copy the workflow ID, which you will need in [Step 2: Configure the Face Biometric authenticator policies in IDaaS](#step-2-configure-the-face-biometric-authenticator-policies-in-idaas).

### Table: Workflow templates

| Storage Type  | Registration Template                                    | Authentication Template                             |
| ------------- | -------------------------------------------------------- | --------------------------------------------------- |
| Local storage | Document and Motion with On-device storage               | Authentication with On-device storage               |
| IDaaS storage | Document and Motion with Customer Infrastructure storage | Authentication with Customer Infrastructure storage |

### Create the required workflows

1. Open the [Entrust Identity Verification documentation](https://documentation.identity.entrust.com/getting-started/workflow-studio-product/) for reference.
2. Log into Entrust Identity Verification **Workflow Builder**.
3. Using the provided **Workflow Summary Table**, create the required workflows.
4. Open a text editor, such as Notepad. Copy and save the **Workflow ID** for each workflow template, and note the template name that matches each workflow ID. You will use these workflow IDs in [Step 2: Configure the Face Biometric authenticator policies in IDaaS](#step-2-configure-the-face-biometric-authenticator-policies-in-idaas).
5. In the text file, record the **Property name** of the Authentication Workflow.

## Step 2: Configure the Face Biometric authenticator policies in IDaaS

1. Click Menu icon **>** **Policies > Authenticators**. The **Authenticators** page appears.

2. Click **Face Biometric**. The **Face Biometric** page appears.

3. In the **Registration Workflow ID** field, paste the registration workflow ID you created in Entrust Identity Verification in [Step 1: Create the required workflows in Entrust Identity Verification](#step-1-create-the-required-workflows-in-entrust-identity-verification).

4. In the **Authentication Workflow ID** field, paste the authentication workflow ID you created in Entrust Identity Verification in [Step 1: Create the required workflows in Entrust Identity Verification](#step-1-create-the-required-workflows-in-entrust-identity-verification).

5. Confirm that the **Authentication Input Name** matches the Entrust Identity Verification workflow input **Property name** that you noted in [Step 1: Create the required workflows in Entrust Identity Verification](#step-1-create-the-required-workflows-in-entrust-identity-verification).

note
The **Authentication Input Name** is not required for local storage of user biometrics.

6. Set the **Renewal Time** to the number of days before a user must re-register a Face Biometric.

7. Select the **Default First Name Attribute** from the drop-down list. This is the first name attribute sent to Entrust Identity Verification for matching verification.

8. Select the **Default Last Name Attribute** from the drop-down list. This is the last name attribute sent to Entrust Identity Verification for matching verification.

9. Select the device that users will use during registration and authentication:

   - **Web** to use a Web browser to run identity verification.
   - **Mobile** to use a mobile device to run identity verification.

10. If you select **Mobile** for registration and authentication, do the following:

    1. Leave the default setting for **Application Launch Scheme**.
    2. Enter the **Activation Lifetime** to set the amount of time in seconds that a user has to activate their Face Biometric.
    3. Select **Allow Unsecure Device** to allow the Face Biometric to run on an unsecured device (such as custom ROM Androids or jail-broken iOS devices).
    4. Select **Enable Mutual Challenge** to require users to respond to a mutual push authentication challenge. When enabled, users must match the challenge that appears on the IDaaS page with the mutual challenge shown in their Entrust Identity soft token app.
    5. Select **Require Identity Verification** to require users to perform face biometric authentication during registration of the selected authenticator.

info
Currently, only Entrust Soft Token is available for Identity
Verification, and only with mobile devices.

11. Click **Save**.

## Step 3: Create a custom authentication flow and resource rule

Create a custom authentication flow and a resource rule to allow Face Biometric as a second-factor authenticator.

1. Create a custom authentication flow and enable Face Biometric for second-factor authentication. See [Create authentication flows](/docs/authentication-and-security/create-and-manage-resource-rules/create-authentication-flows.md).
2. Create a resource rule that uses the custom authentication flow that allows Face Biometric for second-factor authentication. See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md).

## Step 4: Optional. Enable Face Biometric in the Registration policy

To include Face Biometric in the user registration flow, go to the **Registration Authenticators** list in the Registration policy and set **Face Biometric** to **Required** or **Optional**. See [Configure user registration](/docs/people-and-access/manage-user-policies/configure-user-registration.md).