About Passkeys and Social Login
Passkeys and social login provide straightforward ways to configure access to your Iru tenant. Users can create their own passkeys, or use their existing Google or Microsoft account to access your tenant. While they’re easy to configure, they do have inherent limitations compared to configuring a Single Sign-On authentication method. If you’re looking to Require Authentication for enrollment, passkeys and social login can only be used for manual enrollments.This article covers passkeys for signing into Iru Endpoint and managing authentication under Access. For passkeys your people use to sign into Iru Identity applications, see Authenticators and Manage authenticators.
How Passkeys and Social Login Work
Passkeys use standards-based technology that eliminates shared secrets, making them resistant to phishing attacks. When a user registers a passkey, it’s stored in their credential manager and can be synced across their devices. During login, the credential manager authenticates the user without requiring a password. Social login allows users to authenticate using their existing Google or Microsoft accounts. For Microsoft Social, authentication matches users based on their User Principal Name (UPN) in Microsoft Entra ID, not just their email address. Google Social and Microsoft Social can be limited to specific domains for additional security.Passkeys
Designed to replace traditional passwords, passkeys offer a more secure and user-friendly way to sign into websites and applications. You can see Apple’s About the security of passkeys and Use passkeys to sign in to websites and apps on iPhone pages for more information.Send Authentication Registration Request
Admins and Account Owners can send authentication registration requests to users so they can register a passkey.1
Navigate to the Account Menu Button
In Iru Endpoint, in the sidebar, click the Account Menu Button.
2
Access Authentication Settings
Click the Access option in the menu.
3
Select User
Click the ellipsis (⋮) next to the user you would like to send the authentication registration request to.
4
Select Manage Authenticators
From the ellipsis (⋮) menu, select Manage authenticators.
5
Send Authentication Registration
Click the Send Authentication Registration button.
6
Accept Authentication Registration Email
Click the Accept button in the invitation email.
7
Click Register Passkey
Click the Passkey button under the Register a Passkey section.
8
Complete Passkey Registration
Follow the prompts for your preferred credential manager to register the passkey.
9
Choose Passkey at Login
You can now choose the Passkey button at the Iru login page.
10
Select Passkey from Credential Manager
Choose your passkey from your credential manager to authenticate.
Register a New Passkey
You can register additional passkeys for your account without an administrator sending a registration request. You may register multiple passkeys per user account.1
Open My Account
In the sidebar, click the Account Menu Button, then select My Account.
2
Navigate to Authenticators
In the My Account page, click Authenticators.
3
Add Authenticator
Click the + Authenticator button.
If you see a notice that you cannot add additional authenticators without an existing one, contact an administrator to send a registration link as described in the Send Authentication Registration Request section.
4
Select Passkey
In the Add authenticator dialog, click the Passkey button.
5
Save in Credential Manager
Follow the prompts to save the passkey in your preferred credential manager.
6
Complete Passkey Sign-In
When prompted, authenticate using an existing passkey. If your existing passkey is stored in a different credential manager, select it from that credential manager when prompted.
7
Complete Registration
Follow the prompts to complete the passkey registration.
Credential Managers
It’s important to save your passkeys in a way that allows you to access them across multiple devices. Most popular credential managers, such as 1Password and Apple’s Passwords app, support saving and synchronizing passkeys. When registering passkeys, if the expected credential managers do not prompt to save the passkey, check the settings of the related app or browser extension to ensure that prompts to save passkeys are enabled. If you have multiple credential manager browser extensions enabled, you may need to disable the other extensions to avoid conflicts.Manage Your Passkeys
You can suspend or delete your registered passkeys.1
Open My Account
In the sidebar, click the Account Menu Button, then select My Account.
2
Navigate to Authenticators
In the My Account page, click Authenticators.
3
Expand Authenticator
Click the disclosure triangle (⌄) to the right of the authenticator you would like to suspend.
4
Suspend Authenticator
Click Suspend authenticator to temporarily disable the authenticator.
5
Delete Authenticator
You must suspend an authenticator before you can delete it.
6
Confirm Authenticator Deletion
Click Yes, delete to complete deleting the authenticator.
7
Unsuspend Authenticator
You can also click Unsuspend authenticator if the wrong authenticator was suspended.
Manage Passkeys for Team Members
You can suspend, delete, and reset all of the registered passkeys for team members.1
Navigate to the Account Menu Button
In Iru Endpoint, in the sidebar, click the Account Menu Button.
2
Access Authentication Settings
Click the Access option in the menu.
3
Select User
Click the ellipsis (⋮) next to the user you would like to manage.
4
Select Manage Authenticators
From the ellipsis (⋮) menu, select Manage authenticators.
5
Reset All
If you want to remove all passkey registrations from a user, click the Reset all button.
This action will remove all authenticators for the given user. Registering a new authenticator will be required to log in. See Iru Account Recovery for recovery options.
6
Expand an Authenticator
Click the disclosure triangle (⌄) to the right of the authenticator you would like to suspend.
7
Suspend Authenticator
Click Suspend authenticator to temporarily disable the authenticator.
8
Delete Authenticator
You must suspend an authenticator before you can delete it.
9
Confirm Authenticator Deletion
Click Yes, delete to complete deleting the authenticator.
10
Unsuspend Authenticator
You can also click Unsuspend authenticator if the wrong authenticator was suspended.
Social Login
Social login allows users to authenticate using their existing Google or Microsoft accounts without needing to configure complex Single Sign-On authentication methods. There are two social login options available in Iru: Microsoft Social and Google Social.Limit Authentication to Domain
For Google Social and Microsoft Social, you can optionally limit authentication to one or more domains. This allows you to restrict social logins to your organization’s specific domains. Another level of security you can add after limiting to specific domains is to enable Multi-Factor Authentication for the social login platforms. Learn more about using MFA for signing in with Google Workspace and Office 365:To use a social login method for Require Authentication during enrollment, you’ll need to limit that method to specific domains. See Configure Require Authentication for Enrollment for more information.
Microsoft Social
When using the Microsoft Social authentication method, the match between the user in Iru and the user in Microsoft is based on the User Principal Name (UPN). This is an important distinction because a user’s email address and UPN could be different. In cases where the email address in Microsoft Entra ID matches the email of the user in Iru, it will still fail if the UPN of the related user in Microsoft Entra ID does not match.Manage Tenant Authentication
You can either allow or disallow Passkey, Google Social, and Microsoft Social tenant authentication methods individually. You cannot disallow the authentication method that was used to access your current session.Related Articles
Iru Account Recovery
Help team members regain access when they lose a passkey or authenticator
Single Sign-On
Configure SSO and manage Passkey, Google Social, and Microsoft Social tenant authentication
Authenticators
How passkeys and Iru Access work for Iru Identity application sign-in
Manage authenticators
End-user guide for passkeys, Iru Access, and backup devices