> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Entrust Identity Verification

Entrust Identity Verification lets you verify user identity during onboarding using government-issued ID scanning and face biometrics. For Entrust IDV documentation, see [Entrust Identity Verification documentation](https://documentation.identity.entrust.com/). This guide explains the problem that Entrust Identity Verification solves, how it compares to Identity Provider verification, and when to use it.

## Overview

Organizations that use Entrust Identity as a Service (IDaaS) often need to verify the identity of new users before granting access to applications and resources. Traditionally, this verification relies on an external SAML or OIDC Identity Provider: the user authenticates with the Identity Provider, and IDaaS confirms the returned claims match the expected user attributes.

While Identity Provider verification works well when an established Identity Provider is already in place, it has limitations:

- Not all organizations have an external Identity Provider available for user verification.
- Identity Provider verification confirms that a user can authenticate with the Identity Provider, but it does not confirm that the person behind the screen matches a physical identity document.
- Organizations in regulated industries may require stronger identity assurance than a federated login can provide.

Entrust Identity Verification addresses these gaps by offering document-based identity verification combined with face biometrics. Users scan a government-issued ID and complete a facial recognition check. On successful verification, IDaaS sets the user status to Verified and automatically provisions a Face Authenticator that the user can use for future authentication.

## How it works

Entrust Identity Verification uses the Entrust Identity Verification SDK to guide users through a document and biometric verification flow. The high-level process is as follows:

1. An administrator enables Entrust Identity Verification in the user verification policy settings.
2. When a user signs in for the first time (or when verification is required), the verification page presents the option to verify with Entrust Identity Verification.
3. The user scans a government-issued ID document (for example, a passport or driver license) using the Entrust Identity Verification SDK in the browser or on a mobile device.
4. The user completes a facial recognition check to confirm they match the ID document.
5. Entrust Identity Verification processes the verification and returns a result to IDaaS.
6. If the verification succeeds, IDaaS sets the user status to **Verified** and automatically creates a **Face Authenticator** associated with the user.

The auto-provisioned Face Authenticator is immediately available for future authentication. Administrators can configure it as a second-factor authenticator for scenarios such as password recovery, enabling users to reset a forgotten password with a face scan instead of relying on email or SMS.

---

## Verification options compared

IDaaS supports two approaches to user verification. You can enable one or both, depending on your requirements.

| Aspect                                 | Identity Provider verification                | Entrust Identity Verification                                |
| -------------------------------------- | --------------------------------------------- | ------------------------------------------------------------ |
| Verification method                    | SAML or OIDC Identity Provider authentication | Government-issued ID scan and face biometrics                |
| Requires an external Identity Provider | Yes                                           | No                                                           |
| Identity assurance level               | Depends on the Identity Provider              | High: combines document verification with biometric matching |
| Auto-provisions an authenticator       | No                                            | Yes: creates a Face Authenticator on success                 |
| Supports web and mobile                | Yes                                           | Yes                                                          |
| Can be combined with the other option  | Yes                                           | Yes                                                          |

When both options are enabled, users can choose their preferred verification method during onboarding.

---

## When to use Entrust Identity Verification

Consider enabling Entrust Identity Verification in the following scenarios:

- **No external Identity Provider available**: Your organization does not have a SAML or OIDC Identity Provider to use for verification, or you do not want to depend on one for onboarding.
- **High-assurance identity verification**: Regulatory or compliance requirements demand that users prove their identity with a government-issued document and a biometric check, not just a federated login.
- **Defense in depth**: You want to offer both Identity Provider verification and Entrust Identity Verification so that users have a fallback option if one method is unavailable.
- **Passwordless recovery**: You want to auto-provision Face Authenticators during onboarding so that users can use face biometrics for password recovery and second-factor authentication without a separate enrollment step.

---

## Best practices

Follow these recommendations when deploying Entrust Identity Verification:

- **Configure Face Biometrics first.** Entrust Identity Verification requires a fully configured Entrust Identity Verification account and Face Biometric authenticator with valid registration and authentication workflow IDs. Complete the account setup before enabling the feature. See [Manage Face Biometrics with Entrust Identity Verification](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md).
- **Offer multiple verification methods.** When possible, enable both Identity Provider verification and Entrust Identity Verification. This provides a fallback if one method is temporarily unavailable and gives users flexibility during onboarding.
- **Leverage the auto-provisioned Face Authenticator.** After verification, the Face Authenticator is available for password recovery and second-factor authentication. Configure password reset to accept Face Biometric as a second factor to improve the user experience.
- **Test before a broad rollout.** Verify the end-to-end flow, including the Entrust Identity Verification SDK experience on web and mobile, with a small group of users before enabling Entrust Identity Verification for your entire organization.

---

## Next steps

- [Set up Entrust Identity Verification](/docs/people-and-access/manage-user-policies/set-up-entrust-identity-verification.md): Step-by-step instructions for enabling Entrust Identity Verification, including prerequisites, admin configuration, and user flows.
- [Configure user verification](/docs/people-and-access/manage-user-policies/configure-user-verification.md): Configure verification settings, including Identity Provider and Entrust Identity Verification options.
- [Manage Face Biometrics with Entrust Identity Verification](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md): Set up your Entrust Identity Verification account, workflow IDs, and Face Biometric authenticator policies.