How-To: Approve Security Key Unblock Requests in Keytos Shield

Learn how to approve security key unblock requests in Keytos Connect, so users with a blocked or newly bootstrapped YubiKey can set their own PIN and start using their key.

Overview - What are Security Key Unblock Requests?

A user’s security key is blocked when it’s newly bootstrapped, or when the user enters the wrong PIN too many times. To use the key again, the user requests an unblock in Keytos Connect. After you approve the request, the user sets a new PIN on their key.

Prerequisites for Approving Unblock Requests

  1. You have completed Keytos Shield identity security onboarding.
  2. You have the Owner or Identity Administrator role on your Keytos Shield subscription, so you can see Admin access in Keytos Connect.
  3. Allow administrators to unblock user security keys is set to Yes, and you are a credential manager. See the unblock options in your enrollment and recovery settings.

Step-by-Step Guide - How to Approve an Unblock Request in Keytos Connect

Step 1 - How to Open Unblock Requests

  1. Open Keytos Connect and sign in with your administrator account.

  2. On the Identity management page, under Admin access, click Unblock security keys.

    Keytos Connect Identity management page with Unblock security keys highlighted under Admin access

Step 2 - How to Review and Approve the Request

  1. Keep Review user unblock requests selected in the drop-down. The number next to it shows how many requests are waiting.

  2. Review the request’s Requester, Date requested, Time requested, Serial number, and Security key type. If you weren’t expecting the request, confirm it with the user before you approve it.

  3. Click Approve. To reject the request instead, click Delete.

    Keytos Connect Unblock security keys page showing a user's unblock request for a YubiKey 5 USB C NFC with the Approve button highlighted

  4. The request disappears from the list. When there are no more requests, the page shows No unblock requests pending.

    Keytos Connect Unblock security keys page showing No unblock requests pending after approving the request

The user now sees Approved on Unblock a key in their Keytos Connect, and can set a new PIN on their security key.

Other Ways to Unblock a User’s Security Key

The drop-down on the Unblock security keys page also has these options:

  • Allow user to unblock security key: Let a user unblock their key without waiting for a request.
  • Get user security key PUK: Get the PIN-Unblocking-Key (PUK) for a user’s key, which the user enters with the Unblock with PUK option.
Keytos Connect Unblock security keys drop-down showing Review user unblock requests, Allow user to unblock security key, and Get user security key PUK