How-To: Manage Identity Settings in Keytos Shield on Keytos Docs

How-To: Configure Onboarding Domains for Keytos Shield Identity Security

Sun, 08 Nov 2026 01:22:09 -0500

Overview - Which Domains Can Onboard to Keytos Shield?

The Domain setting controls who identity security is enabled for. Shield lists every domain in your Entra ID tenant, and only users whose accounts are on an allowed domain can enroll security keys. This lets you roll out passwordless sign-in one domain at a time, or keep test and service domains out of Shield.

Prerequisites for Configuring Onboarding Domains

Step-by-Step Guide - How to Configure Onboarding Domains in Keytos Shield

Step 1 - How to Open the Domain Settings

Open the Keytos Shield global portal in your browser (US Government Portal) and open your region-specific Shield endpoint under Existing subscriptions.

How-To: Configure Security Key Enrollment and Recovery in Keytos Shield

Sun, 08 Nov 2026 01:22:09 -0500

Overview - How Do Users Enroll and Recover Security Keys in Keytos Shield?

The Enrollment and recovery settings control what Shield puts on each security key, how users prove who they are before they get or recover a key, and what happens when a user locks their key by entering the wrong PIN too many times. You chose some of these settings during identity security onboarding, and you can fine-tune all of them here.

How-To: Configure Smart Card and Security Key Settings in Keytos Shield

Sun, 08 Nov 2026 01:22:09 -0500

Overview - What are Keytos Shield Smart Card Settings?

The Smart cards settings control which security key models your users can request and how those keys protect their credentials. This includes how often users must touch their key, when they must enter their PIN, and how strong that PIN must be. We recommend keeping the defaults unless you have a specific compliance requirement, because they give you the strongest phishing-resistant protection.

How-To: Configure Smart Card Certificate Settings in Keytos Shield

Mon, 09 Nov 2026 01:22:09 -0500

Overview - What are Keytos Shield Certificate Settings?

When you use smart card (CBA) credentials, Keytos Shield issues certificates to your users’ security keys from your cloud PKI. The Certificates settings control how those certificates are registered in Entra ID, whether encryption keys are backed up, and give you the CA certificates that Entra ID needs to trust them.

Prerequisites for Configuring Certificate Settings

Step-by-Step Guide - How to Configure Certificate Settings in Keytos Shield

Step 1 - How to Open the Certificate Settings

Open the Keytos Shield global portal in your browser (US Government Portal) and open your region-specific Shield endpoint under Existing subscriptions.

How-To: Configure Alternative Admin Accounts in Keytos Shield

Sun, 08 Nov 2026 01:22:09 -0500

Overview - What are Alternative Accounts in Keytos Shield?

Many organizations give administrators a second account, such as adm_jsmith@contoso.com, to keep privileged access separate from everyday work. In Keytos Shield, these are called alternative accounts. Instead of treating them as unrelated users, Shield links each alternative account to the user’s primary account by a naming pattern, so administrators can get phishing-resistant credentials for both accounts.

You can add as many alternative account patterns as you need, for example one for domain admins and another for break-glass accounts.