As a Microsoft Entra Verified ID IDV partner, 1Kosmos gives locked-out users a way back in when every auth method is gone. The user completes a government ID scan and liveness check, and 1Kosmos returns a verified result to Entra to restore access.
Integration type
Auth/IDP
Overview
When a user loses every registered MFA method, Entra's self-service reset has nothing left to try. This click-to-deploy Microsoft Security Store listing lets 1Kosmos verify a government ID and liveness selfie, then return a pass or fail result that restores access and re-enrolls a passkey, with no engineering work required to stand up.
What we solve
SSPR only works if the user has one recovery factor left, whether that's a phone, an app or a backup email. Losing them all leaves only one option: a help desk call, often $70 each, where an agent verifies identity and resets access by hand. That call is slow for the user and costly at scale, and it puts a real security decision in the hands of whoever picks up the phone.
Prerequisites
Microsoft Entra ID P1 license
Verified ID enabled and Face Check configured in the tenant
Authentication Administrator role in the Microsoft Entra tenant
Contributor or Billing Administrator role on the Azure subscription, required to subscribe to an identity verification provider
Passkeys enabled in the Authentication Methods Policy, so users can re-enroll after recovery
Configuration values
Setting | Options |
|---|---|
Recovery mode | Evaluation (tests the flow without recovering accounts) or Production (fully recovers accounts and re-enrolls authentication methods) |
User groups | Include: all users or specific groups. Exclude: specific groups, applied feature-wide |
Identity verification provider | 1Kosmos, selected from subscribed providers |
Claim mapping | Provider first name maps to Entra firstName; provider last name maps to Entra surName |
Integration steps
Step 1: Subscribe to 1Kosmos in the Microsoft Security Store From the Account Recovery overview page in the Microsoft Entra admin center, choose Get Solution to open the 1Kosmos listing. Select a billing subscription, resource group, and resource name, then choose a pricing plan, such as pay-as-you-go with a free trial, and place the order.
Step 2: Activate the subscription Once the SaaS subscription is ready, select Configure account now to open the 1Kosmos activation page. Enter subscriber details, including name, email, and phone number, and select Subscribe. 1Kosmos configures the community and confirms activation by email in less than 15 minutes.
Step 3: Enable Account Recovery in Entra In the Microsoft Entra admin center, go to Entra ID > Account recovery and complete the setup checklist: configure Verified ID, set up Face Check with Verified ID, and enable passkeys so users can re-enroll after recovery.
Step 4: Create an identity verification profile From the Profiles tab, select Add to start the profile wizard. Name the profile, choose a recovery mode (start with Evaluation to test before moving to Production), select the user groups it applies to, and select 1Kosmos as the provider.
Step 5: Test, then move to production Run the profile in Evaluation mode with a small group to confirm the flow completes correctly. Once validated, switch to Production mode to allow full account recovery.
How the recovery flow works for end users
The user loses access and initiates account recovery in Microsoft Entra ID. Microsoft redirects the user to 1Kosmos.
The user completes identity proofing: government-issued ID verification, biometric liveness detection, 1:1 facial matching between the selfie and the ID.
1Kosmos issues a Microsoft Verifiable Credential, stored in the user's Microsoft Authenticator. No sensitive personal data is exposed.
Microsoft validates the credential, issues the user a Temporary Access Pass, and the user re-enrolls their authentication methods.
Integration notes
This flow replaces reliance on self-service password reset, which fails once every recovery factor is gone. Verification runs against a government ID and biometric liveness detection instead, a phishing-resistant path to restoring access.
1Kosmos is published in the Microsoft Security Store and Microsoft Marketplace as Identity Verification by 1Kosmos.
