.jpg)
{% endhint %}
### **6.** Configure additional functions for your key, including Password Management and OTP provider (optional step)
* [Use the Hideez key for password management.](/hideez-client-app/account-management/account-creation)
* [Optionally, integrate One-Time Passwords (OTP) as an additional security feature.](/hideez-client-app/account-management/account-creation#hideez-client-as-a-one-time-password-otp-generator)
# Passkey guide
Passwordless SSO with Passkeys
### Minimum requirements for using a smartphone as a Passkey
{% hint style="info" %}
Here are the minimum requirements for using a smartphone as a Passkey on Android and iOS:
#### Android
1. **Operating System:** Android 9.0 or later.
2. **Google Play Services:** Version 19.2.75 or later, which provides support for Passkeys.
3. **Biometric Authentication:** The device should support biometric methods (fingerprint, face recognition) or PIN code for secure authentication.
#### iOS
1. **Operating System:** iOS 15 or later.
2. **Devices:** iPhone or iPad with Face ID or Touch ID support.
3. **iCloud Keychain:** iCloud Keychain must be enabled to sync Passkeys across devices.
{% endhint %}
### About the Passkey
{% hint style="success" %}
Based on FIDO standards, **passkeys** are a replacement for passwords that provide faster, easier, and more secure sign-ins to websites and apps across a user’s devices. Unlike passwords, passkeys are always strong and phishing-resistant.
Passkeys simplify account registration for apps and websites, are easy to use, work across most of a user’s devices, and even work on other devices within physical proximity.
**Passkey may include:**
* Biometric authentication using Android devices;
* Touch ID / Face ID using iOS devices;
* Windows Hello;
* External security keys (like [**Hideez Key**](https://hideez.com/products/hideez-key-4) or YubiKey).
{% endhint %}
### Seting Passkey on the Hideez Server
#### 1. Sign in to your Hideez server using the Hideez account
.jpg)
.jpg)
%20(1).jpg)
.jpg)
Add a device
Scan QR code
Configure Hideez Client
.jpg)
{% endhint %}
### 5. Configure Additional Features (Optional)
You can enable additional features for your Hideez Key:
* [**Password management.**](/hideez-client-app/account-management/account-creation)
* Integration of [**One-Time Passwords (OTP)**](https://enterprise.hideez.com/hideez-client-app/account-management/account-creation#hideez-client-as-a-one-time-password-otp-generator) as an additional authentication factor.
### **6. Add New Users:**
New users can be added via:
* [**Entra ID**](https://enterprise.hideez.com/hideez-server-integration/microsoft-entra-id/import)
* [**Active Directory (On-Premises)**](https://enterprise.hideez.com/hideez-server-integration/active-directory-on-premises/import-and-sync-users-from-active-directory-on-premises)
* [**Manually**](/hideez-enterprise-server/employees/how-to-add-an-employee)
{% hint style="info" %}
**Note:** If users have physical Hideez Keys, their serial numbers must be added [manually](/hideez-enterprise-server/hardware-vaults/how-to-add-hideez-key-into-the-server) by the administrator.
{% endhint %}
Once invited, users will receive an email and can choose their preferred login method:
* [**The mobile Application**](/quick-start-guides/guide-for-hideez-enterprise-server-on-cloud/mobile-app) allows Passwordless SSO and PC login.
* [**Passkeys** ](/quick-start-guides/guide-for-hideez-enterprise-server-on-cloud/passkeys)allow Passwordless SSO.
Select “Cross-Platform”
Add a device
Scan QR code
Click “Sign in with a Security Key”
Select enrolled as passkey for Hideez Server
| Deployment of Hideez Enterprise Server | Deployment | ||
| Administration of Hideez Enterprise Server | Administration | ||
| Dashboard of Hideez Enterprise Server | Dashboard | ||
| Management of employees | Employees | ||
| Management of workstations | Workstations | ||
| Hardware security key on Hideez Enterprise Server | Hardware Vaults | ||
| Accounts on Hideez Enterprise Server | Accounts | ||
| Data Protections | Data Protection | ||
| Load Balancing of Hideez Enterprise Server | Enable load balancing |
sudo mysql -h localhost -u root -p
sudo sed -i 's/SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
sudo reboot
docker compose version
# Docker Compose version v2.29.7
Then enter the current password and a new password in the appropriate fields and click **Save**.
{% hint style="info" %}
It is not recommended to use the **
Choose the **"Administrator"** option from the role dropdown list.
#### Step 3
In the Role section, select **Administrator** and click the **Confirm** button.
#### Step 4 **(optional)**
If the user has just been added, the new administrator will need to open the email invitation and follow the provided link.
If the email did not reach the specified address or if the invitation has not been accepted for a long time, you can resend it. Click on the line with the required administrator and click the **Resend Invite** button.
{% hint style="info" %}
Follow all these steps for all the people you want to give administrator rights.
{% endhint %}
# Deleting an admin account
Hideez Enterprise Server – Deleting an admin account
{% hint style="info" %}
You can remove any added administrator by either revoking their admin rights or deleting the account entirely.
{% endhint %}
### **Option 1: Revoke Admin Rights**
**Step 1:**\
Go to the **Employees** section.
The **Secret Key** is a 32-character value provided in **Step 3**.
\
[Learn more about creating accounts via Hideez Client](/hideez-client-app/account-management/account-creation). \
[Learn more about creating accounts on HES](/hideez-enterprise-server/accounts/how-to-work-with-personal-employee-accounts). \
[How to enter credentials with the Hideez key](/hideez-key-enterprise-edition/how-to-enter-credentials-with-hideez-key).
***
### **Disabling 2FA on HES**
#### **Step 1:**
* When the green LED flashes, press the button on the key.
 
You will then be authorized on the HES server.
#### **User nameless Login**
If your key was registered with the "Use User nameless" option:
1. Select the **Sign in with a security key** option.
* When the green LED flashes, press the button on the key.
 
#### Step 3: Managing Your Keys
You can manage your registered keys by renaming or deleting them using the corresponding buttons in the **Security Keys** section.
***
{% hint style="info" %}
This process simplifies user authentication while ensuring security through FIDO key integration on the Hideez Enterprise Server.
{% endhint %}
# Platform authentication on the HES server
Hideez Enterprise Server – Platform authentication on the HES server
{% hint style="info" %}
Platform authentication allows you to use your device's built-in biometric sensors or PIN codes as FIDO keys for secure logins. This method works with **Windows 10-11**, **Apple iPhone**, and **Android** devices.
{% endhint %}
***
## **Adding a key**
### Windows 10-11
1. **Enable Windows Hello Fingerprint** or **PIN** sign-in on your device.
3. In the upper right corner of the window, click the **profile icon**, select **Profile** from the drop-down list, and go to **FIDO2 Authenticators**.
.png?alt=media&token=5eea5562-2a46-46cb-8263-dcdb351b07c7)
.png?alt=media&token=03bf0541-9dc2-433b-90e6-631ffda24e82)
.png?alt=media&token=cc0c0763-22bf-4cb4-aada-1b1412bad1e8)
.png?alt=media&token=2a0f1627-3fd1-44d8-8307-6bbe3baa5d3f)
.png?alt=media&token=9b1aac0c-5ffc-4324-bbc0-b321013a1082)
.jpg?alt=media&token=e27910ec-2c42-4342-b802-8a5b046412aa)
.jpg?alt=media&token=b5c9b9db-107c-4d4a-a79b-a6de9015716d)
{% hint style="info" %}
The only required fields are the First Name and Email. Uniqueness is checked by a bunch of First Name and Last Names.
{% endhint %}
If there is no required company/department/position on the list, you can add them.\
[How to add a company?](/hideez-enterprise-server/employees/how-to-add-a-company#adding-a-company)\
[How to add a Department to the Company?](/hideez-enterprise-server/employees/how-to-add-a-company#adding-a-department)\
[How to manage Positions?](/hideez-enterprise-server/employees/how-to-manage-positions#adding-a-position)
### The 'Hardware Vault' page (optional):
In this step, you can assign the Hideez Key to the Employee. You can choose only from devices in status Ready.\
You can skip this step if you are not sure. Just click **Skip.**
### The 'Account' page (optional):
On this step, you can**,** for example, add a Personal Account for Unlock Workstation. Select account type (Local/Domain/Windows/Azure AD) and add all the required data.
You can skip this step if you are not sure. Just click **Skip.**
### The 'Single Sign On' **page:**
On this step you can enable the Single Sign On option if the [SAML protocol is configured on your server](/hideez-enterprise-server/configuring-saml-protocol) and requires[ two-factor authentication](/hideez-enterprise-server/single-sign-on-settings/user-settings#two-factor-authentication-required).
After this step, the Employee will be created. At the next step, you need to provide the device activation code to the user (in case you tied the vault to the user on the "Hardware vault" step).
### The 'Activation' page:
You can send the code to the employee's email (it will be displayed immediately if it is added to the employee or you can enter it manually) or report the code in any convenient way (e.g. by phone or a messenger application).
The user will have to enter the activation code when trying to connect the Hideez Key.
You can [read more about the Activation mechanism](/hideez-enterprise-server/keys-management/keys-activation-mechanism).
# Employees management
Hideez Enterprise Server – Employee management
### **On Hideez Enterprise Server, you can perform the following actions with employees:**
* Edit personal information.
* See the employee's details
* Change roles.
* Deactivate accounts.
* Delete accounts.
* Unlock accounts after failed login attempts.
* [Activate or reactivate the Single Sign-On (SSO) feature](/hideez-enterprise-server/employees/edit-employee/activate-or-reactivate-the-single-sign-on-sso-feature)
## **Editing Personal Information**
An administrator can edit the following details of an employee:
* First Name.
* Last Name.
* Email Address.
* Phone Number.
* Company.
* Department.
* Position.
**How to edit:**
1. Go to the **Employees** section.
2. Select the required employee and click **Actions → Edit**.
.png?alt=media&token=da14cff1-3f7f-4be8-8d06-acd25d83aee2)
{% endhint %}
## Unlock employee account
\
If a user attempts to log in with the wrong password 10 times, their account will be locked. The user can wait for 15 minutes for the account to be automatically unlocked and then log in with the correct password, or they can ask the administrator to manually unlock the account following the guide below.
Activating or reactivating user SSO
