How To Get Started with Keytos Shield Identity Security

How to Register & Consent the Keytos Shield Entra ID Application

Keytos Shield uses native Entra ID authentication to provide a seamless passwordless experience for your users. Begin by registering the Keytos Shield Entra ID application using the link below. Make sure to use your Global Administrator account (or forward the link to your Global Administrator) to complete the consent process.

• Commercial
• Government

Single Click

The easiest way to register the applications is to click the button below while logged in with your Global Administrator account:

Register Keytos Applications

Manual URL

Alternately, you can copy & paste the following URL into your browser. Make sure you are logged in with your Global Administrator account before accessing the link.

https://login.microsoftonline.com/organizations/adminconsent?client_id=2963e596-88f5-43a1-ab17-68b8026c6468&redirect_uri=https://portal.keytos.io/Welcome

You will see a consent screen similar to the one below. Click Accept to register the applications in your tenant.

Available for GCC High tenants only

This registration is specifically for Azure GCC High tenants and will not work for commercial or other government clouds. An Azure GCC High tenant is required to use this registration.

Single Click

The easiest way to register the applications is to click the button below while logged in with your Global Administrator account:

Register Keytos Applications

Manual URL

Alternately, you can copy & paste the following URL into your browser. Make sure you are logged in with your Global Administrator account before accessing the link.

https://login.microsoftonline.us/organizations/adminconsent?client_id=2cf07322-0273-4052-bd9b-e38c1c433803&redirect_uri=https://portal.keytos.us/Welcome

For more information on these specific permissions and why they are needed, please refer to the Keytos Shield FAQs.

How to Create Your Keytos Shield Subscription

A Keytos Shield subscription handles permissions, billing, and central configuration for your organization. You can create a subscription directly with us, or through the Azure Marketplace. Both options provide a 1-month free trial, and you can cancel at any time.

• Azure Marketplace
• Shield Portal

The interactive onboarding guide in Keytos Shield walks you through every setting you need to start issuing phishing-resistant security keys to your users. Follow these steps to open it.

1. Open the Keytos Shield global portal in your browser. (US Government Portal). Make sure to sign in with the same account you used to create your Keytos Shield subscription.

2. Under Existing subscriptions you’ll see your region-specific Keytos Shield endpoint. Open it to access your Shield portal.

   

3. From the left-hand menu, expand Identity security and click Onboarding.

   

4. The Set up passwordless identity page shows the five onboarding steps and a progress bar. Steps unlock in order as you mark each one complete.

   

How to Register and Consent the Keytos Shield Identity Security Application

Keytos Shield uses a second Entra ID application, Keytos Shield Identity Security, to create phishing-resistant credentials for your users, such as FIDO2 passkeys and smart card certificates on their security keys.

Use your Global Administrator account (or forward the link to your Global Administrator) to complete the consent.

1. While signed in with your Global Administrator account, click the button below to open the admin consent page for the Keytos Shield Identity Security application.

   Register Keytos Shield Identity Security

   You can also copy and paste this URL into your browser:

   https://login.microsoftonline.com/organizations/adminconsent?client_id=7ac2dedd-8239-469d-88fd-699148118828
   

2. On the Permissions requested screen, check that the application is Keytos Shield Identity Security. The application asks for permission to:

   • Read and write all users’ full profiles.
   • Read and write all users’ authentication methods, so Shield can register security keys for your users.
   • Sign in and read user profile.

3. Click Accept to consent the application for your organization.

   

4. Return to the Keytos Shield onboarding guide to continue to the next step.

How to Configure Your Identity Profile and Security Keys

Your identity profile defines which FIDO2 security keys your users can use, who can enroll them, and how users prove their identity before they get a key. We recommend starting with the defaults and narrowing them later from Identity settings once your rollout is underway.

1. Which security keys do you want to support?

   • Open the drop-down and select the security key models you want to allow. All key types is selected by default and includes the supported AuthenTrend, HID Crescendo, and YubiKey 5 series models, including FIPS and biometric versions.
   • If your organization standardizes on one model (for example, YubiKey 5 FIPS keys for compliance), clear All key types and select only that model. At least one key type must be selected.
   

2. Are users allowed to bring their own security keys?

   • Select Yes to let users enroll a supported security key they already have.
   • Select No if users should only enroll security keys your organization provides.
   

3. Who can enroll security keys through Keytos?

   • Keep All licensed users checked to let every user with a Shield license enroll a security key.
   • To start with a pilot group, uncheck All licensed users and search for the Entra ID users or groups who can enroll. Users only need to be selected directly or be a member of one selected group.
   

4. How do you want users to create or recover their security key? Choose how users verify their identity before Shield lets them set up a new security key or recover a lost one. At least one option must be on.

   • Government ID and face recognition: Users verify their identity with a government-issued ID and face recognition.
   • Existing Entra ID credential: Users sign in with their current Entra ID credential to enroll their security key. This option is on by default.
   • IT help desk: Your IT help desk verifies the user and helps them set up or recover their security key.
   

5. Do you want to enable backup and recovery of encryption keys?

   • We recommend keeping this set to Yes so users can recover their encryption keys if a security key is lost or replaced. If you disable it, anything encrypted with a lost key’s encryption certificate can’t be recovered.
   • Note that this is the encryption key in the 9D slot, not the authentication key in the 9A slot.

6. Click Mark as complete to save your identity profile and continue to the next step.

   

How to Choose the Root CA for Your Security Key Certificates

Keytos Shield includes a cloud PKI that issues the certificates on your users’ security keys. In this step, you choose which Root CA those certificates chain up to. If you don’t have an on-premises PKI, Shield creates and manages the Root CA for you.

Use the tabs below to follow the path that matches your environment.

• No existing PKI (recommended)
• Bring your own offline Root CA

How to Choose Which Domains and Accounts Can Enroll Security Keys

In this step you choose which of your Entra ID domains can onboard to Shield, and set up alternative accounts such as separate admin accounts.

How to Select the Domains That Can Onboard with Shield

1. Under Which domains can onboard with Shield?, check Can onboard with Shield for every domain your users sign in with. Users whose accounts are on a checked domain can enroll security keys.

   • Your Entra ID tenant’s Default domain is checked by default. You can uncheck it if needed.
   • A domain that an alternative account uses (see below) must be checked to allow users to enroll security keys for accounts on that domain.
   

How to Set Up Alternative Accounts (optional)

Many organizations give administrators a second account, such as adm_jsmith or jsmith-admin, to keep privileged access separate from everyday work. Setting up alternative accounts lets Shield link these accounts to the user’s primary account.

1. For Do you have alternative accounts?, select Yes. If you don’t use alternative accounts, select No and skip to the last step below.

2. Select Prefix or Suffix, and enter the text your alternative accounts add to the primary account name (for example adm_ for adm_jsmith).

3. Select the Primary account domain and the Alternative account domain.

4. Choose who can set up which account:

   • The primary account can set up this alternative account: lets users enroll a security key for their alternative account while signed in with their primary account.
   • This alternative account can set up the primary account: lets users enroll a security key for their primary account while signed in with their alternative account.

   Have more than one naming pattern? You can set up one alternative account here. Add more from the Alternative accounts settings page once onboarding is complete.

5. Click Mark as complete to save your domains and accounts and continue to the next step.

   

How to Share Keytos Connect with Your Users

Your users enroll their security keys with the Keytos Connect app. The last onboarding step gives you a download link to share with them.

1. Under Keytos Connect download link, click Copy to copy the link to your clipboard.

   

2. Share the link with your users, for example in an email or on your intranet, so they can install Keytos Connect and enroll their security keys.

3. Click Complete setup to finish onboarding.