Offline PIN for manual approvals

For tenant admins, approvers, auditors.

With manual approval, a request waits for an approver in the portal. When the device cannot reach the portal (no network, a hotel or airport sign-in page, an outage), the request cannot be approved the normal way. The offline PIN is the way out: the device shows a challenge code, the user reads it to your helpdesk on the phone, the helpdesk gets a PIN for it in the portal and reads it back. Enterprise license.

A PIN:

• works for one request: the challenge is computed from the request, the file (path and SHA-256), the user and the minute it was shown, so a PIN for one request never approves another;
• works on one device: every device has its own secret key;
• works for a short time: the validity you choose (15 minutes by default) from the minute the device shows as “code valid from”;
• works once: the device refuses a challenge that was already used.

Turn it on

Under Settings, Offline PIN for manual approvals:

Setting	Default	Meaning
Allow offline PINs	off	The offline path on every device of the tenant
PIN validity	15 minutes	5 to 60 minutes
PIN length	8 digits	6 to 10 digits

Each device then gets its own key with its next policy check while it is online (a device enrolled after you turned it on gets it at enrollment). The device page shows when the device has confirmed its key. A device that has not received its key yet cannot use the offline path, so turn the setting on well before people travel.

Without an Enterprise license the devices keep the offline path off.

What the user sees

The user starts a program that needs approval. When the device cannot reach the portal, the AdminExplorer window says Portal unreachable. Ask your helpdesk for an offline PIN and shows:

• the challenge code, for example K7QD-M2XA,
• the time the code is valid from,
• the file name, the user and the device name,
• a PIN field and a Verify button.

The user calls the helpdesk and reads the challenge code and the time.

Issue a PIN (helpdesk)

Approvers and tenant administrators can issue PINs.

1. Open Devices, the device the user names, and choose Offline PIN on the device page.
2. Check what the user reads: the file name, the user and the device name must match what you expect. If they do not, do not issue a PIN.
3. Enter the challenge code (8 characters: letters A to Z and digits 2 to 7; the hyphen is optional).
4. Choose the time the device shows after code valid from. The list shows the current minute and the minutes before it, in your local time with the UTC time in brackets, because the user may be in another time zone.
5. Enter a reason, for example the ticket number and what the user needs to run. It is required and audited.
6. Choose Get PIN and read the PIN to the user. It is shown once and not stored; if the user mistypes it, get a new one.

The user types the PIN and selects Verify. The program starts exactly as after a normal approval: the device checks again that the file has not changed and that the same user is still signed in.

Limits

• At most 10 PINs per device per hour.
• A wrong PIN counts: after 5 wrong PINs within 15 minutes the device locks the offline path for 15 minutes and tells the user.
• A used challenge cannot be used again. If the user needs to run the program once more, they start it again and read the new challenge.
• A PIN for an older minute than the validity is refused by the device; ask the user to start the request again.

Device keys

Every device has its own key. The portal keeps it only encrypted with your tenant’s key in the key store, and the device keeps it protected so that only the system can read it. A tenant administrator can choose Rotate device key on the device page, for example when a device was lost and found again; the device picks up the new key at its next policy check, and PINs keep using the old key until then. Revoking a device deletes its key.

Audit

Every PIN issued is recorded in the audit log with kind Offline PIN: who issued it, when, for which device, the challenge, the minute and the reason. The PIN itself is never recorded. When the device is back online it sends its own records: the request approved with an offline PIN (decision Approved, approved by offline-pin: and the key id, with the challenge), wrong PINs and lockouts. Filter the audit page by the kind Offline PIN; the device page lists the device’s recent records. See Audit records and reports.

Related guides

• How AdminExplorer elevates
• Audit and reports
• Security model overview