--- title: What users see for Authenticate slug: access-guide/what-users-see-for-authenticate docTags: createdAt: 2026-10-09T06:41:07.209Z --- After configuring Authenticate on UEM, Windows or macOS desktops get notification to authenticate and register Authenticate. :::hint{type="info"} Click to view the full images in this section. ::: A silent registration is enabled by default for Authenticate. The following provide information about the user experience with Authenticate: - [Workflow on Windows desktop](docId\:l22LV6mJo12dK50mVYk1V) - [Workflow on macOS desktop](docId\:l22LV6mJo12dK50mVYk1V) - [FIDO Key Rotation Details and Required Actions](docId\:l22LV6mJo12dK50mVYk1V) ## Workflow on Windows desktop **Workflow for Silent Registration** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Hb3hN3qMNGTN1EazLeN1d_miauthenticatewindows3.png" alt caption size="88" width="881" height="497"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/GwN9SrIV4BZwokuLHuJPr_miauthenticatewindows12.png" alt caption size="47" width="469" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/e2UrMrdboxy5judNerApP_miauthenticatewindows5.png" alt caption size="47" width="466" height="194"} **Workflow for QR Code** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Hb3hN3qMNGTN1EazLeN1d_miauthenticatewindows3.png" alt caption size="88" width="881" height="497"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/5SGC00yT1ertakAPPdmWF_miauthenticatewindows4.png" alt caption size="47" width="468" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/e2UrMrdboxy5judNerApP_miauthenticatewindows5.png" alt caption size="47" width="466" height="194"} **Workflow for QR Code and password** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/UvCBu6P2snOi1nWf3Balq_miauthenticatewindows6.png" alt caption size="47" width="466" height="193"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/_kFGdwqCpdaAE2D3ZNGBC_miauthenticatewindows7.png" alt caption size="46" width="463" height="195"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/GA38pRw-WypiBGlv3Ipmj_miauthenticatewindows8.png" alt caption size="47" width="466" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/ek2LU49-scDMs1QHScy5Q_miauthenticatewindows9.png" alt caption size="46" width="461" height="193"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/U4FtjyzMyz2XSLgcnD7Jj_miauthenticatewindows10.png" alt caption size="47" width="466" height="194"} **Registration Status** ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/zzYlEnobuPwFshq1ABmXK_miauthenticatewindows11.png" position="flex-start" size="66" width="463" height="194" initialPath="../Resources/Images/MiAuthenticateWindows11.png" githubPath="Resources/Images/MiAuthenticateWindows11.png" darkWidth="463" darkHeight="194" showCaption="false"} **Lock pass initiated on a Windows lock screen** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/AFAbniUlvAaX2FEGLvAIo_miauthenticatewindows1.png" alt caption size="88" width="880" height="489"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/eMaIqNSm41o0PLDjJ-Uzn_miauthenticatewindows2.png" alt caption size="31" width="305" height="273"} ## Workflow on macOS desktop Silent Registration \>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/o8UIV_wy04JtiFTz4ndrc_miauthenticatemac2.png" alt caption size="47" width="469" height="183"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/inXs20VAPJm4XNfLwRqxW_miauthenticatemac5.png" alt caption size="47" width="467" height="180"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/HrX4iDh8OpIfHBQr28a2X_miauthenticatemac6.png" alt caption size="47" width="467" height="183"} Workflow on a macOs light mode \>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/o8UIV_wy04JtiFTz4ndrc_miauthenticatemac2.png" alt caption size="47" width="469" height="183"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Rg6ZreKZRUggd6FPyDuho_miauthenticatemac3.png" alt caption size="47" width="470" height="179"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/f-hfO9vfvibESMEsc-_O__miauthenticatemac4.png" alt caption size="47" width="466" height="179"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/inXs20VAPJm4XNfLwRqxW_miauthenticatemac5.png" alt caption size="47" width="467" height="180"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/HrX4iDh8OpIfHBQr28a2X_miauthenticatemac6.png" alt caption size="47" width="467" height="183"} **Registration Status** ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/nq9KpfhOZEYEJHyeGCsHW_miauthenticatemac7.png" position="flex-start" size="66" width="463" height="181" initialPath="../Resources/Images/MIAuthenticateMac7.png" githubPath="Resources/Images/MIAuthenticateMac7.png" darkWidth="463" darkHeight="181" showCaption="false"} ## FIDO Key Rotation Details and Required Actions ### Key Generation During registration, two asymmetric key pairs are generated: - Desktop Signing Key (DSK) – used to perform FIDO Authentication - Desktop Encryption Key (DEK) – used to encrypt any data, needs to be sent to the Desktop Trust Agent. These keys are governed by: - **Rotation Period for FIDO Key** (default: 180 days) :::hint{type="info"} Increasing Rotation Period does not apply retroactively to already-registered agent. It takes effect only if the user updates keys during grace period or upon agent re-registration. ::: - **Grace period to rotate the FIDO Key before expiry** (e.g., 7 or 15 days) :::hint{type="info"} Increasing Grace Period enables the notifications to appear earlier than before. Example: With a 15-day grace period, the warning starts on Day 165 (for a 180-day rotation). ::: This doesn't have any negative impact on the functionality. ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/WVtj_4jHST2nVSAuYUETi_authenticatefidokey1.jpg) Configurations are managed in the Zero Sign-On settings in the Access console. ### User Access – Normal Flow 1. Select **Sign in using Ivanti Zero Sign-On Authenticate** option. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/AReBbp1aDHSVRP3OvLp5m_authenticatefidokey2.jpg" size="79" isUploading="false" initialPath="../Resources/Images/AuthenticateFidoKey2.jpg" githubPath="Resources/Images/AuthenticateFidoKey2.jpg" width="786" height="862" darkWidth="786" darkHeight="862" showCaption="false" indent="1"} 2. Authentication succeeds if keys are valid. ### Pre-Expiry Notification Flow Within the configured grace period before key expiry (e.g., Day 179 of a 180-day rotation): A popup notification appears informing the user about upcoming key expiry. ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/XSUS-GWnvj0r5Xt1hZztn_authenticatefidokey3.jpg) :::hint{type="info"} Users cannot check the key expiry status ahead of time. Notification appears only during the configured grace period. ::: Two options are presented: 1. **Update Now**: Triggers regeneration of keys via Ivanti FIDO Authenticator. 1. Click **Open Ivanti Zero Sign-On Authenticate**. ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/ppR-i9x3PAfPXPvrjOOPE_authenticatefidokey31.jpg) 2. Registration is updated automatically. ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/FvS7L1JDNdU1ceysUlGty_authenticatefidokey32.jpg) ![](https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/j5tCc73tSVmn7Q-vzugds_authenticatefidokey33.jpg) 2. **Later**: Dismisses the warning. You can continue to log in if keys are still within valid period. ### Post-Expiry Behavior Once the rotation + grace period expires: Keys become invalid. 1. You will get an "expired" screen when selecting ZSO Authenticate. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Im6aEuPOESWJHw7_WKqKk_authenticatefidokey4.jpg" position="flex-start" size="100" width="1036" height="583" initialPath="../Resources/Images/AuthenticateFidoKey4.jpg" githubPath="Resources/Images/AuthenticateFidoKey4.jpg" darkWidth="1036" darkHeight="583" showCaption="false" indent="1"} 2. ZSO authentication is blocked. The following user alternatives are available: 1. Choose another login method (if enabled by admin): - Sign in using QR Code - Sign in using Password - Sign in using Security key or Biometric 2. Re-register the ZSO Authenticate Agent: - Relaunch the Desktop Trust Agent. - Follow the registration flow again. :::hint{type="info"} Device does not need to be re-enrolled. Only the ZSO Authenticate Agent is re-registered. :::