SAM 7.0 supports two kinds of FIDO2 credential — a shared passkey synced across a user’s devices, and a device-bound hardware security key. Both are activated from the same place in SAM and both are managed the same way.
A FIDO2 credential is cryptographically bound to the SAM site, so it cannot be replayed against a look-alike site, and there is no shared secret for a user to disclose. At activation the device creates a key pair: the private key stays on the device or security key and never leaves it, and SAM stores only the matching public key.
The credential itself does not change. The same credential is used for every subsequent sign-in; what changes each time is the signed challenge — a fresh, single-use value that cannot be replayed. This is a different mechanism from a one-time passcode, where the code itself changes each time.
A single account can hold up to four passkeys, in any combination of hardware keys and shared passkeys. Register at least two. SAM has no separate recovery flow for a lost passkey — a lost credential is replaced by removing it and registering a new one, so a user holding only one credential who loses it has no self-service route back in.
Please see the SAM FIDO2 User Guide for more information.
What You Need
Nothing is sent to you in advance. There is no key to distribute, no code to e-mail and no enrolment package — and therefore nothing that can be intercepted. To activate a credential you need one of the following:
- A hardware security key with a PIN already set on it, and a USB port to plug it into. No phone is required.
- A phone or tablet with a credential manager and a screen lock — fingerprint, face or PIN.
- A computer whose platform supports passkeys, for example Windows Hello on Windows or Touch ID and Face ID on a Mac.
NOTE: For users in environments where phones are not permitted, the hardware security key route is the recommended option.
Activate Passkey
Credential management is reached from My Account, which opens the Activate your security methods page. Where a credential is mandatory, the page shows a required-credential counter.
Selecting ACTIVATE on the Passkeys card hands off to the browser. Where the credential is stored is decided at the first browser prompt: continue for a hardware security key (Route A), or select Cancel to choose a phone, tablet or the computer itself (Route B).
Route A – Hardware Security Key
To activate a hardware security key:
1. Security key setup. The browser confirms the site the credential is being created for. Continue to proceed.
2. Continue setup. Consent to the site seeing the make and model of the key.
3. Security key PIN. Enter the PIN set on the key.
4. Touch the key. Tap the key to confirm physical presence.
5. Add security key. SAM takes over again and asks for a nickname. A name is required.
The card then shows as Active with the nickname and the credential’s assurance grade.
IMPORTANT! Wording varies by browser and platform.
Route B – Passkey on Phone or Tablet
To activate a passkey on a phone or tablet:
1. Select Use a phone or tablet. A QR code is displayed.
2. Scan the QR code with the camera on the device where the passkey should live.
3. Confirm with the fingerprint, face or PIN set on that device. The passkey is created and stored there.
4. SAM then shows the same Add security key screen, pre-filled with a default name from the device’s credential manager. Keep the name or replace it, then Save.
NOTE: The QR code is displayed in two places: here, during activation, where it binds the device to the credential, and again at step-up when a shared passkey is the credential being used. It is not currently required to sign in to SAM.
Where the computer itself supports passkeys — Windows Hello on Windows, Touch ID or Face ID on a Mac — the passkey can be stored on the computer instead, and is presented directly at sign-in with a biometric or PIN prompt.
Manage Passkeys
An account can hold up to four passkeys, in any combination — all hardware keys, all mobile passkeys, or a mix of the two. Each activated card displays its own nickname and assurance grade.
| Action | What to do | What to expect |
|---|---|---|
| Add another | Select ACTIVATE on the Passkeys card again. | The same activation sequence runs. Up to four passkeys in total. |
| Rename | Open the credential and enter a new nickname. | You must re-authenticate with that passkey before the new name is saved. |
| Remove | Remove the credential from credential management. | Step-up authentication is required and a removal reason is captured. |
| Replace a lost key | Remove the old credential and register a new one. | There is no recovery flow — a lost passkey is replaced by re-registering. |
IMPORTANT! SAM has no separate recovery flow for a lost or damaged passkey. Keep at least one spare credential registered so that losing one does not lock you out.
Sign-in/Step-up
Once a passkey is active it is used in three places: at sign-in, when stepping up into an application that requires stronger authentication, and when stepping up into an administrative tab. Select the security key option and the browser takes over:
- With one hardware key, the browser prompts for the PIN and a tap, and the credential is used directly.
- With more than one hardware key, each key signals in turn and you tap whichever one you want to use.
- With a passkey held on a phone, the browser presents the device and you confirm with that phone’s fingerprint, face or PIN.
- With a passkey held on the computer, it is presented directly with a biometric or PIN prompt.
NOTE: FIDO2 elevation is required once per session, not on every application launch.
QR Codes
The QR code is not limited to activation. It is displayed in two situations:
- At activation, when a passkey is being stored on a phone or tablet. Scanning the code binds that device to the credential.
- At step-up, when the credential being used is a shared passkey. The code is scanned with the device that holds the passkey, and the step-up is confirmed there.
A QR code is not currently required to sign in to SAM. A hardware security key never presents one, at sign-in or at step-up.
Stepping up into Administrative Tab
FIDO2 is supported as a step-up method for administrative tabs as well as for applications. Where an administrative tab requires stronger authentication, an administrator holding a passkey or a security key uses it to elevate, in exactly the same way as for an application launch — the browser prompts for the credential, and the tab opens once it has been presented.
The same session rule applies: elevation is required once per session, not each time an administrative tab is opened.
Requiring FIDO for Application
A sponsor can require FIDO2 at application level. Each application is configured with one of three MFA settings.
| Setting | What it accepts | When to use it |
|---|---|---|
| FIDO2 | Either a shared passkey or a hardware security key. | Broadest option — requires phishing-resistant MFA without dictating the credential type. |
| FIDO2 – Passkeys | Shared passkeys only. | Where synced, cross-device credentials are the preferred model. |
| FIDO2 – YubiKeys | Hardware security keys only. | Strictest option — where a device-bound credential is required. |
Troubleshooting
| Issue | What is happening | What to do |
|---|---|---|
| An application’s launch button shows “MFA Not Met”. | The application requires a FIDO2 credential the user does not yet hold. | Select the indicator to go to credential management and activate the required credential, then launch the application again. |
| A shared passkey is not accepted for an application. | The application is set to FIDO2 – YubiKeys, which accepts hardware security keys only. | Activate a hardware security key. A security key satisfies all three settings. |
| The user has no phone, or phones are not permitted on site. | A phone is one storage option, not a requirement. | Use a hardware security key, or store the passkey on the computer where the platform supports it. |
| The Add security key screen will not save. | A nickname is required on this screen. | Enter a name for the credential and save again. |
| A passkey has been lost or damaged. | There is no recovery flow for a lost passkey. | Remove the old credential and register a replacement. Keep a second credential registered to avoid being locked out. |
| ACTIVATE does not add a fifth credential. | The account already holds the maximum of four passkeys. | Remove a credential that is no longer needed before registering another. |
| Identity proofing is requested before a credential can be configured. | The application is set to Level 3, which requires identity proofing first. | Complete proofing from the Get 2FA prompt or from credential management, then return and activate the credential. |