Credential Governance
Verify User
The help desk confirms a caller is who they say, with the methods the caller enrolled, before helping them.
Completes when the challenge passes and the verified message is shown.
https://mcp.avatier.com/mcp
Ask in Plain Language
Run Verify User from the AI Assistant You Already Use
In Avabot and MCP, Verify User checks the person in the conversation, normally you: pick one of your own methods and answer it. To verify a different caller, the help desk uses the web app. One completed verification = one Secure Outcome; failed attempts are never billed.
You: Verify me with my authenticator app. Avatier: method: Google Authenticator · code: accepted · verification: passed
Why it matters
A Help Desk Call Should Start with Proof of Identity.
A caller who sounds right has not yet proved who they are.
What a verification needs
A challenge the caller answers with methods they enrolled in and their MFA workflow allows, such as Security Questions, an SMS or email code, an authenticator app, a push or the Identity Challenge Card.
What goes wrong by hand
Checking identity with a few questions over the phone depends on the agent, and is only as strong as what someone else could look up.
What Verify User does
The agent selects the user and a method, the caller answers the challenge or approves the push, and a 'successfully verified' message is shown when the challenge passes. Each passed challenge is written to the audit log under Help Desk.
What per-seat pricing charges
Per-seat IAM charges for every licensed seat, whether the help desk verifies anyone this month or not. Pay Per Identity Action™ charges only for completed verifications.
The Action
How Verify User Runs
On the web, help desk agents walk through these screens while the caller answers. In Avabot and MCP, the person in the conversation picks one of their own methods and answers it.
Select the User
Help desk agents in your tenant's Help Desk group select the user. Excluded and out-of-scope users are refused, as for other help desk actions.
Choose Whether to Bypass
Optional. If you are a super user and your tenant allows bypass, you are asked whether to bypass.
Pick a Method
Pick one of the user's enrolled methods from their MFA workflow, or from a help-desk-only workflow if your tenant defines one. The step is skipped when only one method is available. Users who are not enrolled are blocked by default; your tenant can instead require two questions from their directory attributes.
The Caller Answers
The caller answers the challenge or approves the push, for example Security Questions, an SMS or email code, Google or Microsoft Authenticator, Duo, Okta, PingID or Fortinet, RSA or the Identity Challenge Card. This repeats if the workflow needs more than one method.
See the Result
A 'successfully verified' message is shown, with the option to verify another user. Nothing is changed, and verifying does not pre-authorize later actions: unlock and reset each run their own verification.
Available on Web, Mobile, Teams, Avabot chat and MCP.
Avabot chat and MCP require the current (.NET 10) Avatier server.
In Avabot chat and MCP, Verify User checks the person identified in the conversation, normally the signed-in caller, not another user named by a help desk agent, and reports pass or fail.
Secure Outcome
What Counts as Done
A Secure Outcome is a completed, verified, policy-compliant identity action. A verification completes when the challenge passes and the verified message is shown. Nothing is changed, and no request is created. One completed verification = one Secure Outcome.
Evidence
- An audit-log entry under Help Desk for each passed challenge
- The 'successfully verified' message
Guardrails
Your Assistant Asks. Avatier Decides.
Verified First
Avatier verifies the person before sensitive changes, with the methods your policy already allows.
Acts as the Signed-In User
OAuth sign-in to your own tenant. No shared service account, no API key to manage.
Never Makes Up Values
The connector only sends what the person actually said, and asks when something is missing.
Pay Per Identity Action™
Pay per Completed Verification
Pay per completed verification. Failed attempts are never billed.
| Compared | Manual or Per-Seat IAM | Verify User, Pay Per Identity Action™ |
|---|---|---|
| What you pay for | Every licensed seat, whether it acts or not | Completed verifications only |
| Failed attempts | No line between an attempt and a result | Attempts, failures and retries are never billed |
| The work | Manual intervention or tickets | The caller passes a challenge with their own enrolled methods, and nothing is changed |
| Evidence | Silent failures and missing audit trails | An audit-log entry under Help Desk for each passed challenge |
Pay Per Identity Action™ is in invitation-only preview. Pricing is shared with qualified organizations.
Works with the Methods a Verification Uses
Verify User uses the caller's Avatier password-management enrollment and the MFA providers your tenant has configured. For users who are not enrolled, it can use directory attributes from Active Directory or LDAP, when configured.
- Duo
- Okta
- RSA
- Fortinet
- Microsoft Authenticator
- LDAP
- Microsoft
- Microsoft Authenticator, and Active Directory attributes for users who are not enrolled, when configured.
- Enrollment
- Only methods the user has enrolled in, and that their workflow allows, are offered.
Avatier MCP
New to Avatier MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
Up and Running in Under a Minute
One URL works in every MCP client. Pick yours, copy, paste, sign in.
Microsoft Copilot Studio
Claude Code
OpenAI Codex
Cursor
Frequently Asked Questions
Why does Verify User only offer security questions for some users?
The methods come from the user's MFA workflow and their own enrollments. If the workflow or the user has only questions, only questions appear.
Can a help desk super user skip verification?
Yes, if the tenant turns on super-user bypass (off by default). The agent is asked whether to bypass.
Does a verification let the agent reset the password without asking again?
No. Verifying does not pre-authorize later actions. Unlock and reset each run their own verification.
Can the help desk verify someone through Avabot?
Avabot's verification checks the person who is chatting. To verify a different caller, the help desk uses the Help Desk screen in the web app.
Is Avatier secure enough for large enterprises or regulated industries?
Absolutely. Avatier applies zero-trust controls, maintains fully auditable identity records, and holds SOC 2 Type II and ISO 27001 certifications. It also helps organizations support requirements and evidence needs associated with NIST, SOX, HIPAA, and GDPR. Every provisioning action is policy-enforced and auditable.
What is AI-driven configuration?
Avatier's AI-driven config turns plain-language intent into working policy. Rather than hand-coding rules, connectors, and roles, administrators describe what they need and Avatier recommends and sets up provisioning rules, role mappings, and workflows, then validates them before they go live. It shortens deployment from months to days and keeps configuration consistent, auditable, and free of custom scripting.
What is Pay Per Identity Action™?
Pay Per Identity Action™ is Avatier's pricing mechanic. Customers pay only for completed, verified, policy-compliant identity actions, called Secure Outcomes.
Is it the same as pay-per-action advertising?
No. Pay per action (PPA) is performance-marketing vocabulary for paying when an ad converts. Pay Per Identity Action™ charges for completed identity work.
How do I get started?
Getting started is free, deployment services are included, and a 45-day money-back guarantee applies. Contact Avatier for pricing for your organization.
What is MCP?
The Model Context Protocol is an open standard, stewarded by the Linux Foundation, that lets AI assistants call real systems through connectors instead of custom integrations.
How is it billed?
Pay Per Identity Action™ is in invitation-only preview: each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed.
Verify User
You've Automated the System. Now Secure the Credentials.
Help desk agents verify callers with the methods those callers enrolled, before they help.