> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# User verification

User verification prompts a user to verify their identity before registration or authentication. You can configure verification using external SAML or OIDC Identity Providers, Entrust Identity Verification (Face Biometrics powered by Onfido), or both.

When you enable verification, at least one Identity Provider or Entrust Identity Verification must be selected.

## Identity Provider verification

If you enable user verification for SAML or OIDC Identity Providers, the following applies:

- Users must verify against an external SAML or OIDC Identity Provider before using an IDaaS application.
- The user verification process includes first authenticating to IDaaS and then completing the SAML or OIDC Identity Provider authentication.
- The registration period can be used to authenticate to IDaaS before performing user verification.
- Authentication includes ensuring that the returned Identity Provider token claims match the expected claims of the user as configured by the administrator.
- If a user verification message has been configured, users must approve the verification message to complete verification. Verification messages can be customized. See [Customize login page text and messages](/docs/customization/customize-login-messages.md).

See [Manage Identity Providers](/docs/identity-providers.md) for more information.

## Entrust Identity Verification

If you enable Entrust Identity Verification:

- Users verify their identity by scanning a government-issued ID and completing a facial recognition check using the Entrust Identity Verification SDK.
- On successful verification, the user status is set to Verified and a Face Authenticator is automatically created and associated with the user.
- The auto-provisioned Face Authenticator can be used for future authentication, including password recovery.

info

Before you can enable Entrust Identity Verification, you must configure Face Biometric settings, including your Entrust Identity Verification account and workflow IDs. See [Manage Face Biometrics with Entrust Identity Verification](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md).

For an overview of what problem Entrust Identity Verification solves and when to use it, see [Entrust Identity Verification](/docs/people-and-access/entrust-identity-verification.md). For a complete setup guide including prerequisites, user flow, and use cases, see [Set up Entrust Identity Verification](/docs/people-and-access/manage-user-policies/set-up-entrust-identity-verification.md).

### Configure verification settings

1. Click Menu icon **>** **Policies > Registration**. The **Registration** pages appear.
2. Click **User Verification**. The **User Verification** page appears.
3. Select **Verification Enabled** to require users to complete verification the first time they sign in.
4. Under **Identity Providers**, select the Identity Providers that can be used for verification. You must select at least one Identity Provider or enable Entrust Identity Verification.
5. Under **Entrust Identity Verification**, select the **Entrust Identity Verification** checkbox to enable Face Biometric verification. This option is only available when Face Biometric settings are configured.
6. Click **Save.**

warning

If Face Biometric settings are not configured, the **Entrust Identity Verification** option displays a warning with a link to the **Face Biometric authenticator** settings page. Configure Face Biometric settings before enabling this option. See [Manage Face Biometrics with Entrust Identity Verification](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md) for more information.