--- title: What users see for Authenticate slug: access/guide/what-users-see-for-authenticate docTags: createdAt: 2026-09-07T09:11:00.418Z --- After configuring Authenticate on UEM, Windows or macOS desktops get notification to authenticate and register Authenticate. A silent registration is enabled by default for Authenticate. The following provide information about the user experience with Authenticate: - [Workflow on Windows desktop](docId\:l0onsTrpWvsrD4nEFQxnC) - [Workflow on macOS desktop](docId\:l0onsTrpWvsrD4nEFQxnC) - [FIDO Key Rotation Details and Required Actions](docId\:l0onsTrpWvsrD4nEFQxnC) ## Workflow on Windows desktop **Workflow for Silent Registration** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/5jaX6Gqf-C5yOazZYQ7Mx_miauthenticatewindows3.png" alt caption size="80" width="881" height="497"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/D3wg1ep113Nr5FUav4P0F_miauthenticatewindows12.png" alt caption size="47" width="469" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/UDVrV6eZVv-AfZH1jF1VW_miauthenticatewindows5.png" alt caption size="47" width="466" height="194"} **Workflow for QR Code** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/5jaX6Gqf-C5yOazZYQ7Mx_miauthenticatewindows3.png" alt caption size="80" width="881" height="497"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/1xK0JP0qudJo30mHykDqK_miauthenticatewindows4.png" alt caption size="47" width="468" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/UDVrV6eZVv-AfZH1jF1VW_miauthenticatewindows5.png" alt caption size="47" width="466" height="194"} **Workflow for QR Code and password** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/cGzIyEVYBa3nIJKVQ2gq5_miauthenticatewindows6.png" alt caption size="47" width="466" height="193"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/xvuMywIJsVQE2SNEvq1t1_miauthenticatewindows7.png" alt caption size="46" width="463" height="195"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/KAq-pEBxfyFXT7PSkMB0q_miauthenticatewindows8.png" alt caption size="47" width="466" height="194"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/gVb_jPy0ziIR4APkX3IsE_miauthenticatewindows9.png" alt caption size="46" width="461" height="193"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/n3zBuwtXkV1VNXjixHYpP_miauthenticatewindows10.png" alt caption size="47" width="466" height="194"} **Registration Status** ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/Xxm7jpJl_uO90PQauEwCz_miauthenticatewindows11.png" position="flex-start" size="46" width="463" height="194" initialPath="../Resources/Images/MiAuthenticateWindows11.png" githubPath="HTML5/Resources/Images/MiAuthenticateWindows11.png" showCaption="false"} **Lock pass initiated on a Windows lock screen** :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/kbfDO696fkn3mBNQ0U8_l_miauthenticatewindows1.png" alt caption size="80" width="880" height="489"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/WYaA2Yx_khm66fqobr9zm_miauthenticatewindows2.png" alt caption size="31" width="305" height="273"} ## Workflow on macOS desktop Silent Registration \>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/zan6CrSh_XZOkFVl_4K0e_miauthenticatemac2.png" alt caption size="47" width="469" height="183"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/s7kAT8sE_XElD5airB85f_miauthenticatemac5.png" alt caption size="47" width="467" height="180"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/zzlrEdxkAyaR9Qm32vcpP_miauthenticatemac6.png" alt caption size="47" width="467" height="183"} Workflow on a macOs light mode \>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/zan6CrSh_XZOkFVl_4K0e_miauthenticatemac2.png" alt caption size="47" width="469" height="183"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/59mpLkeDum5S5-ZpU4Xls_miauthenticatemac3.png" alt caption size="47" width="470" height="179"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/25wyncunoXaAcReXl7pjK_miauthenticatemac4.png" alt caption size="47" width="466" height="179"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/s7kAT8sE_XElD5airB85f_miauthenticatemac5.png" alt caption size="47" width="467" height="180"}>>:inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/zzlrEdxkAyaR9Qm32vcpP_miauthenticatemac6.png" alt caption size="47" width="467" height="183"} **Registration Status** ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/_PcY2I6BtRT-5X0q4yq8e_miauthenticatemac7.png" position="flex-start" size="46" width="463" height="181" initialPath="../Resources/Images/MIAuthenticateMac7.png" githubPath="HTML5/Resources/Images/MIAuthenticateMac7.png" showCaption="false"} ## FIDO Key Rotation Details and Required Actions ### Key Generation During registration, two asymmetric key pairs are generated: - Desktop Signing Key (DSK) – used to perform FIDO Authentication - Desktop Encryption Key (DEK) – used to encrypt any data, needs to be sent to the Desktop Trust Agent. These keys are governed by: - **Rotation Period for FIDO Key** (default: 180 days) :::hint{type="info"} Increasing Rotation Period does not apply retroactively to already-registered agent. It takes effect only if the user updates keys during grace period or upon agent re-registration. ::: - **Grace period to rotate the FIDO Key before expiry** (e.g., 7 or 15 days) :::hint{type="info"} Increasing Grace Period enables the notifications to appear earlier than before. Example: With a 15-day grace period, the warning starts on Day 165 (for a 180-day rotation). ::: This doesn't have any negative impact on the functionality. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/TmG2PViUI2TC9w2bxSzoz_authenticatefidokey1.jpg" position="flex-start" size="80" width="991" height="576" initialPath="../Resources/Images/AuthenticateFidoKey1.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey1.jpg" showCaption="false"} Configurations are managed in the Zero Sign-On settings in the Access console. ### User Access – Normal Flow 1. Select **Sign in using Ivanti Zero Sign-On Authenticate** option. :inlineImage[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/XQJ3heERP4msP69zJ5f7W_authenticatefidokey2.jpg" alt caption size="79" width="786" height="862"} 2. Authentication succeeds if keys are valid. ### Pre-Expiry Notification Flow Within the configured grace period before key expiry (e.g., Day 179 of a 180-day rotation): A popup notification appears informing the user about upcoming key expiry. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/ss3BMAnDNCJsirDZikKd2_authenticatefidokey3.jpg" position="flex-start" size="80" width="1106" height="541" initialPath="../Resources/Images/AuthenticateFidoKey3.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey3.jpg" showCaption="false"} :::hint{type="info"} Users cannot check the key expiry status ahead of time. Notification appears only during the configured grace period. ::: Two options are presented: 1. **Update Now**: Triggers regeneration of keys via Ivanti FIDO Authenticator. 1. Click **Open Ivanti Zero Sign-On Authenticate**. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/vWxcCMFm84kUy8E_QA3rS_authenticatefidokey31.jpg" position="flex-start" size="80" width="1100" height="969" initialPath="../Resources/Images/AuthenticateFidoKey3_1.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey3_1.jpg" showCaption="false"} 2. Registration is updated automatically. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/NLvFgAX-cgZ1-NxuynL0R_authenticatefidokey32.jpg" position="flex-start" size="80" width="1102" height="971" initialPath="../Resources/Images/AuthenticateFidoKey3_2.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey3_2.jpg" showCaption="false"} ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/AY0r1QEeeO8vu9fRZo5SF_authenticatefidokey33.jpg" position="flex-start" size="80" width="940" height="412" initialPath="../Resources/Images/AuthenticateFidoKey3_3.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey3_3.jpg" showCaption="false"} 2. **Later**: Dismisses the warning. You can continue to log in if keys are still within valid period. ### Post-Expiry Behavior Once the rotation + grace period expires: Keys become invalid. 1. You will get an "expired" screen when selecting ZSO Authenticate. ::Image[]{src="https://api.archbee.com/api/optimize/V3jJx_afLEcmDauLTrzss/CMRueFskJs-L-HiTkdCrz_authenticatefidokey4.jpg" position="flex-start" size="80" width="1036" height="583" initialPath="../Resources/Images/AuthenticateFidoKey4.jpg" githubPath="HTML5/Resources/Images/AuthenticateFidoKey4.jpg" showCaption="false"} 2. ZSO authentication is blocked. The following user alternatives are available: 1. Choose another login method (if enabled by admin): - Sign in using QR Code - Sign in using Password - Sign in using Security key or Biometric 2. Re-register the ZSO Authenticate Agent: - Relaunch the Desktop Trust Agent. - Follow the registration flow again. :::hint{type="info"} Device does not need to be re-enrolled. Only the ZSO Authenticate Agent is re-registered. :::