> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Add a smart credential

Use this procedure to enroll a smart credential for a user in IDaaS.

## Before you begin

Before you enroll a smart credential, complete the following prerequisites:

1. [Configure certificate authorities](/docs/authentication-and-security/manage-certificate-authorities.md)
2. [Configure smart credential definitions](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials/configure-smart-credential-definitions.md)
3. Optional: Export a certificate trust chain if your users want to use their smart credential for Windows Smart Card logon.
   - See [Export an Entrust Managed PKI CA trust chain](/docs/authentication-and-security/manage-certificate-authorities/configure-an-entrust-managed-pki-ca/export-an-entrust-managed-pki-ca-trust-chain.md) or [Export a Microsoft CA trust chain](/docs/authentication-and-security/manage-certificate-authorities/configure-a-microsoft-ca/export-a-microsoft-ca-trust-chain.md).
   - [Create and auto-populate UPN](/docs/authentication-and-security/manage-smart-login/map-a-user-principal-name-attribute-for-smart-login.md) values for users to use a smart card for Windows Smart Card logon.

note

The digital IDs for a smart credential definition should all come from the same certificate authority.

## Add a smart credential

1. Click Menu icon **>** **Members > Users**. The **Users List** page appears.

2. Click the User ID for the user.

3. Click the **Authenticators** tab. The **Authenticators** page appears.

4. Click Circle Plus icon. A drop-down list of authenticators appears.

5. Select **Smart Credential**. The **Smart Credential** dialog box appears.

6. Select the smart credential definition that contains the PIV data model and enrollment variables you want the smart credential to use. You configure these in [Configure smart credential definitions](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials/configure-smart-credential-definitions.md).

7. Click **Add**. The smart credential appears in the user's list of authenticators.

note
A smart credential in the **Enrolling** state is missing one or more required attributes. For example, if the smart credential definition requires the user's last name and that value is not set in the user profile, the smart credential remains in the **Enrolling** state. Update the user profile with the missing values, then try again. For more information, see [Add users to IDaaS](/docs/people-and-access/manage-members/add-users-to-identity-as-a-service/add-users.md) and [Edit smart credential settings](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials/edit-smart-credential-settings.md).

### Activate a smart credential

After you enroll the smart credential, you must activate it. On the user's **Authenticators** page, do the following:

1. Click Ellipsis Vertical icon to the right of the smart credential that you want to activate. A drop-down list appears.
2. If the user has an email, do the following:
   - Click Square icon **Activate**. The **Activate Smart Credential** dialog box appears.
   - Select the type of smart credential to activate: **Mobile Smart Credential** or **Physical Smart Credential**.
   - Click **Activate**. IDaaS sends the user an email with a QR code and further instructions.
3. If the user does not have an email address, the user must activate the smart credential from the User Portal.

note

Click Ellipsis Vertical icon and select **Re-Activate** from the drop-down list to send another email to the user's email address if the first email was not received or the token expired before activation.

### Validate your changes

After you add and activate the smart credential, validate the result.

1. Confirm the smart credential is in the **Enrolled** state before activation.
2. Confirm the smart credential activates successfully.
3. Confirm all required digital IDs and user attributes have values.
4. Confirm the user receives the activation email, or can activate from the User Portal if no email is set.