Getting Started: Help Desk Verification
Evo Help Desk Verification provides a method of verifying that a user contacting the help desk is who they claim to be by sending a verification message via a trusted contact path such as the Evo Authenticator app, their mobile phone number, or their email address.
This article assumes that you have already completed the basic setup of Evo for your MSP. If not, refer back to our MSP Onboarding Guide before proceeding.
Directories
Connect Your Customer Directories
In order to send Help Desk Verification requests to contact points such as the Evo Authenticator app or mobile phone numbers stored in a directory like Microsoft Entra ID or Google Workspace, the third-party directory where those users exist needs to be synced to Evo.
You can setup Directories in bulk for all of your customers, or you can do it one-by-one as you test and deploy Evo MFA to your customers.
Refer to our Directory Integration articles to complete that process.
Note: You will want to leave the “Automatically Send Welcome Email” option on the Directory turned off for the moment to avoid sending welcome emails prematurely. We will use an Email campaign when we are ready to bulk invite our users, then we will turn the “Automatically Send…” option on after the initial onboarding so that new users going forward are handled automatically.
Connect Your PSA Contacts
You can also link Evo to a supported PSA platform to allow your technicians to pick contact information from PSA contact records.
Refer to our Integrations documentation for details on setting up your specific PSA.
Licenses & Deployment
Assign Licenses
Each user who can have Evo Help Desk Verification requests sent to them needs to have an Evo HDV license assigned to them.
Licenses can be assigned to Tenants in pools, allowing licenses to be automatically granted to new users attempting to use Evo HDV, simplifying this process. You can configure those pool settings, purchase additional licenses, and manually manage license assignments in the Partner Portal.
Refer to our Billing & Licensing article for additional details. Complete the setup of licensing pools and expansion settings according to your preferences and then continue to the next step. Licenses will be assigned to individual users in the next step.
Note: In order for an HDV license to be assigned to a user, that user must exist in an Evo Directory. For cases where you will only be using Help Desk Verification via PSA contact information, you may elect not to sync a third-party directory for that tenant. In that case, you will need to import each user into an “Evo Cloud Directory-as-a-Service” directory in order to create the users to which licenses can be assigned. In most cases, it is simpler to just integrate the customer’s third-party directory such as Entra ID.
End User Setup
Users will be able to receive Help Desk Verification requests via three different methods, depending on the policies you have set:
- Evo Authenticator App. This is the preferred and most secure method because it ties into the user device’s biometrics to ensure that the user receiving the notification is the authorized contact.
- SMS to mobile device. This method can be used in cases where deployment of the Evo Authenticator app isn’t possible and provides additional authentication by using a known contact phone number.
- Email. This method is generally the least secure due to the possibility of email compromise by a bad actor, but it may still be appropriate for some situations.
You will need to setup your users with one or more of the contact methods above, ensuring the Evo Authenticator apps are deployed and registered and/or that appropriate SMS and email contact information is in your directory or PSA.
We also recommend distributing brief training materials to all users on what to expect when they are asked to verify themselves for the first time, though this can also be done in the moment by help desk personnel as the process is generally very simple to understand.
Technician Setup
Integrating Help Desk Verification into your internal MSP procedures and setting up your technicians for success is one of the most important steps in adopting HDV and improving your security posture!
We recommend training your Help Desk staff on the usage of HDV outlined below. If your PSA supports integration of Evo HDV into the PSA interface itself (a “pod” in the PSA screen) then this process can be triggered directly from the contact in the PSA.
Technician Permissions
Verify that the technician users have the Help Desk Verification Role within the Evo Partner Portal.
- Navigate to Evo Admin > Permissions.
- Verify or add the Help Desk Verifications permission to a new or existing Role scoped to the appropriate set of technician users.
Verification Process
- If you want to verify a user, browse to the tenant of the user and select the user you want to verify.
- As long as the permission is enabled, you'll see the User Verification selection option at the bottom of their profile. Select the option to Request Verification.
- For verification via the Evo Authenticator app, a new screen will pop up and a push notification will be sent to their device.
The end user will see this on their device
- Once approved, you'll see the notification on screen change.
If a user denies the verification request, the prompt will change accordingly.
