Help Desk Verification with Microsoft Authenticator and Evo Secure Login

Prerequisites

• Help Desk Verification must be enabled for your environment.

• Eligible users must be created or synced from an Azure Active Directory.

• Users must have the appropriate version of the authentication app:
• Microsoft Authenticator for Microsoft-based verification.
• Evo Secure Login (Version 5.0.5 or higher) for Evo-based verification.

• The admin requesting verification must have the Help Desk Verification role assigned within Role-Based Permissions.

Help Desk Verification Process

1. User Verification Request:
• When a user requests help desk verification, a push notification will be sent to their registered mobile device.
• Evo Admins can use this feature to confirm the caller’s identity before assisting with sensitive requests.

2. Requesting Verification in Evo:
• In the Evo portal, navigate to the Users section.
• Select the tenant and locate the user requiring verification.
• Ensure that Help Desk Verification is enabled.
• Click on the Request Verification button.

• Choose the verification method:
• Microsoft Authenticator App
• Evo Secure Login App

3. User Response:
• The user will receive a push notification on their registered device.
• Once approved, the verification status will update on-screen.
• If denied or if the app version is outdated, an appropriate error message will display.

Granting OAuth Permissions (For Microsoft Authenticator)

Completing OAuth Setup:

1. Sign in to the Azure Portal as a Global Administrator.

2. Navigate to Microsoft Entra ID → Enterprise Applications.

3. Search for and select Evo Security.

4. In the Enterprise Applications section, go to the Permissions tab.

5. Under Admin consent required permissions, locate the Grant admin consent button.

6. Click Grant admin consent for [Your Organization] and confirm.

Required OAuth Permissions:

• UserAuthenticationMethod.Read.All (Application)

• User.ReadWrite.All (Application)

• Application.ReadWrite.All (Application)

• Directory.ReadWrite.All (Application)

• User.ManageIdentities.All (Application)

• User.Read (Delegated)

Important Notes on OAuth Transition

• If your directory was initially created using an Azure app registration, completing the OAuth setup will shift authentication to OAuth-based authentication.

• Evo Security will authenticate and perform actions within your tenant using OAuth instead of previously provided client credentials.

• Once OAuth permissions are successfully granted and verified, you may optionally delete the old app registration only after confirming all necessary permissions are set.

User Setup Requirements

• Have a registered device with either Microsoft Authenticator or Evo Secure Login (Version 5.0.5 or higher).

• Be set up within Evo via directory sync or manual addition.

• Have their mobile device paired with the authentication method chosen.

Additional Information

• If a user does not have a secure login license, they can still use Help Desk Verification by pairing the mobile app via the welcome email QR code link.

• If interested in enabling Help Desk Verification for your environment, contact your Evo Account Manager for more details.

• For support or troubleshooting, reach out to the Evo Security Support Team.