> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Set up Entrust Identity Verification

Entrust Identity Verification uses Face Biometrics to verify user identity during onboarding. When enabled, users complete a government-issued ID scan and a facial recognition check. On successful verification, the user status is set to `Verified` and a Face Authenticator is automatically created and associated with the user.

This feature works on both web and mobile. You can use Entrust Identity Verification with SAML or OIDC Identity Provider verification, or use Entrust Identity Verification by itself.

## Prerequisites

Before you enable Entrust Identity Verification, complete the following:

- Review the [Entrust Identity Verification documentation](https://documentation.identity.entrust.com/) for account, workflow, and SDK requirements.
- Configure your Entrust Identity Verification account in Entrust Identity as a Service (IDaaS). See [Step A: Set up your Entrust Identity Verification account](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido/step-a-set-up-your-onfido-account.md).
- Set up a Face Biometric authenticator with valid registration and authentication workflow IDs. See [Step B: Set up a Face Biometric authenticator](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido/step-b-set-up-a-face-biometric-authenticator.md).

warning

If Face Biometric settings are not fully configured (missing the registration or authentication workflow ID), the **Entrust Identity Verification** option is not available on the **User Verification** page. A warning with a link to the Face Biometric settings page appears instead.

## Enable Entrust Identity Verification

Administrators enable Entrust Identity Verification from the **User Verification** page.

To enable Entrust Identity Verification:

1. Click Menu icon **>** **Policies > Registration**. The **Registration** pages appear.
2. Click **User Verification**. The **User Verification** page appears.
3. Select **Verification Enabled**.
4. Under **Entrust Identity Verification**, select the **Entrust Identity Verification** checkbox.
5. Click **Save**.

info

You must select at least one Identity Provider or enable Entrust Identity Verification when verification is enabled. You can enable both options to give users a choice during verification.

## How users complete verification

When a user signs in for the first time (or when verification is required), the **Verification** page appears. If Entrust Identity Verification is enabled, users see a **Continue with Entrust Verification** button.

### Web verification flow

To complete verification on the web:

1. On the **Verification** page, click **Continue with Entrust Verification**.
2. The Entrust Identity Verification SDK launches in the browser.
3. Follow the on-screen instructions to scan a government-issued ID document.
4. Complete the facial recognition check by following the prompts.
5. After the SDK completes, finalize the verification.

### Mobile verification flow

To complete verification on a mobile device:

1. On the **Verification** page, tap **Continue with Entrust Verification**.
2. The Entrust Identity Verification flow launches on the mobile device or through a QR code linking to the Entrust Identity app.
3. Follow the on-screen instructions to scan a government-issued ID document.
4. Complete the facial recognition check by following the prompts.
5. After the verification completes, the result is returned to IDaaS.

### Verification results

After the user completes the Entrust Identity Verification workflow, the verification result determines the next steps.

| Result           | Description                                                                                                                                                 |
| ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Verified**     | The user is verified. Their status is updated to `Verified` and a Face Authenticator is automatically created. The user can proceed to use the application. |
| **Under review** | The verification requires manual review. The user is notified and must use a different verification method to proceed.                                      |
| **Failed**       | The verification did not pass. The user can retry or use a different verification method.                                                                   |

## Post-verification behavior

After successful verification, the following occurs:

- The user status is set to **Verified**.
- A **Face Authenticator** is automatically created and associated with the user. The user does not need to separately register a Face Biometric authenticator.
- The Face Authenticator is immediately available for future authentication, including password recovery and second-factor authentication.

## Use case: Password recovery with Face Authenticator

After Entrust Identity Verification creates a Face Authenticator for a user, administrators can configure password reset to accept Face Biometric as a second-factor authenticator. This enables users to verify their identity with a face scan when resetting a forgotten password to provide a seamless and secure recovery experience.

To configure this use case:

1. Enable Entrust Identity Verification to automatically create Face Authenticators for users during onboarding (described in this guide).
2. Enable password reset and add Face Biometric as an allowed second-factor authenticator for password recovery. See [Reset a password](/docs/authentication-and-security/manage-authenticators/manage-password-reset.md) and [Enable password reset](/docs/authentication-and-security/manage-authenticators/manage-password-reset/enable-password-reset.md).

When a user forgets their password, they can use the **Forgot your password?** link and authenticate with their face to complete the password reset.

## Next steps

- [Manage Face Biometrics with Entrust Identity Verification](/docs/authentication-and-security/manage-authenticators/manage-face-biometrics-by-onfido.md): Configure Entrust Identity Verification account settings, workflow IDs, and Face Biometric authenticator policies.
- [Configure user verification](/docs/people-and-access/manage-user-policies/configure-user-verification.md): Configure verification settings, including Identity Provider and Entrust Identity Verification options.
- [Reset a password](/docs/authentication-and-security/manage-authenticators/manage-password-reset.md): Enable password reset and configure allowed second-factor authenticators.