Specops Verified ID

Specops Verified ID enables organizations to securely verify user identities using government-issued identification. During verification, the user scans an identity (ID) document such as a passport, national ID card, or driver’s license and completes a live selfie check. The system compares the photo on the identity document with the live capture to confirm that the user is physically present and matches the document holder. Verified attributes from the identity document, including name and date of birth, are then validated against the user record provisioned in Active Directory.

Specops Verified ID supports a broad range of government-issued identity documents used worldwide.

A key use case for Specops Verified ID is Secure Service Desk verification. Users calling the service desk in organizations using Specops Secure Service Desk can verify their identity using government-issued identification, enabling service desk agents to securely confirm the caller’s identity before performing account-related actions.

Specops Verified ID can also be used to securely onboard new employees by verifying their identity when setting their first-day password.

Specops Verified ID is accessible to end users through the Specops:ID mobile app, available for iOS and Android, or through a standard web browser. With the Specops:ID mobile app, users can enroll with government-issued identification through Specops Verified ID or other authentication factors. Enrollment uses the mobile device’s biometrics (fingerprint or facial recognition) or a device PIN to help secure the enrolled authentication method.

With the web browser flow, users can complete identity verification and authentication without using the Specops:ID mobile app. If the web browser flow is started on a desktop device, the user must switch to a mobile device to scan the ID document and complete the face liveness check, since desktop web camera quality is generally insufficient for reliable verification.

Configuring Specops Verified ID

To set up Specops Verified ID for the first time:

Log in to the Specops Authentication Web: https://login.specopssoft.com/authentication/admin
In the left sidebar, select Identity Services, then select Specops Verified ID.
At the top of the page, select the lowest verification level accepted:
- Low: Users verify with the Specops:ID app or in a web browser. The app checks moving security features, such as holograms, when present on the ID. Reading the chip is optional.
- Medium: Users verify with the Specops:ID app only. The app checks moving security features of the ID, such as holograms. IDs without these features cannot meet this level. Reading the chip is optional.
- High: Users verify with the Specops:ID app only, and the app must read the NFC chip of the ID. Passports and many national ID cards have a chip. Users need a phone that supports NFC and can read the ID's chip. Users whose phones cannot read the chip cannot verify at this level.
Go to ID document scanning.
1. Under Name matching, select an option from the dropdown to control how much variation is allowed between the user's name in Active Directory or Entra ID and the name on the ID document. This is useful if the scan misses a letter or if the account name contains a spelling error.
  - Exact match: Names must be identical.
  - Strict match: Very small differences only. This is the recommended setting.
  - Fuzzy match: Moderate tolerance for common spelling variations and small typos.
  - Loose match: Highest tolerance; allows more variation but increases the chance of matching similar-looking names that do not belong to the same person.
    
    Note
    
    The user's name in Active Directory or Entra ID may differ from the legal name on the ID document. This mismatch can cause the ID document capture step to fail. See Matching rule considerations for how to resolve this.
2. Under Date of birth matching, choose whether to compare the user's date of birth with the one on the ID: Off, Full date of birth, Year only or Month and day only.
  
  Note
  
  Before using Date of birth matching, users must be pre-enrolled with a date of birth. See Matching rule considerations for more information.
3. Under Multi-page scanning, select one of the following options:
  - Multiple pages: Users must scan all pages or sides of a multi-page document, including the back of an ID card.
  - Main page only: Users scan only the front of an ID card or the main page of a passport.
  Note
  
  This setting applies when authenticating through either the Specops:ID app or a web browser. Web browsers do not read the ID document's NFC chip.
  
  In the Specops:ID app, NFC chip verification is controlled by the selected verification level and may override Multi-page scanning. When NFC chip verification is used, users may need to scan additional pages even if Main page only is selected. If Multiple pages is selected, remaining pages may be skipped once enough information has been collected to read the chip.
Go to Face scanning.
1. Under Liveness check, choose one of the following options to verify that the user is physically present in front of the camera:
  - Active: Stricter and helps reduce spoofing risk.
  - Passive: Easier for users but may be less strict.
    
    Note
    
    It is recommended to start with active verification unless your organization has a strong reason not to.
2. Under Face matching, adjust the Similarity percentage slider to set the face similarity threshold. The threshold is used when comparing a user's live capture with their ID document photo.
  - Higher threshold: Stronger security, potentially more false rejections.
  - Lower threshold: Smoother user experience, potentially weaker matching.
    
    Note
    
    It is recommended to use the default value initially, then tune it based on real support outcomes.
Click Save and confirm that the save was successful.
Perform a real end-to-end test with a test user, see Authenticating with Specops Verified ID.

Matching rule considerations

Name matching

Specops Verified ID compares names on the ID document with the user's given name and surname in Active Directory or Entra ID. If a legal name has been enrolled, it is used instead.

Each part of the name being checked must match a name on the ID document. The ID document may contain additional names, such as middle names, and matching will still work. Order and capitalization do not matter. Strict match, Fuzzy match, and Loose match control how much spelling variation is accepted; each still requires every name part to match.

Does my organization need to enroll users' legal names?

Legal-name enrollment is optional. There is no need to enroll users whose directory names match their ID documents. For example, "John Doe" in the directory matches "John Doe" or "John Bob Doe" on an ID document.

Consider enrollment when directory names differ from the names on users' ID documents. For example, the directory might contain "John Doe" while the passport shows "Jonathan Doe". If users' given names in the directory are generated values, such as "student-1252", these will also fail to match their ID documents.

Before enrolling names from an HR system or another source, check that all parts of the legal names you plan to enroll appear on the ID documents your users typically use. Usually, enroll only first and last names. Enrolling "John Bob Doe" will fail if the document shows only "John Doe" or "John B Doe".

Enrolling a name to override directory names

Enroll a legal name to use instead of the user's given name and surname in Active Directory or Entra ID.

For Active Directory users, use one of the following methods:
- Use the PowerShell cmdlet to enroll the legal name for comparison during authentication:
```
Add-SAVerifiedIdEnrollment `
  -Username <USERNAME> `
  -LegalName <LEGALNAME>
```
- Use the PowerShell cmdlet to remove the legal name:
```
Remove-SAVerifiedIdEnrollment `
  -Username <USERNAME> `
  -ClearLegalName
```
- Alternatively, enroll from Secure Service Desk. For more information, see Managing Specops Verified ID Enrollments.
For Entra ID users, enroll from Secure Service Desk. For more information, see Managing Specops Verified ID Enrollments.

Date of Birth Matching

While Name Matching is always used as a matching rule, Date of Birth Matching requires users to be pre-enrolled with a date of birth.

Use the following PowerShell cmdlet to pre-enroll a date of birth:

Add-SAVerifiedIdEnrollment `
  -BirthYear <BIRTHYEAR> `
  -BirthMonth <BIRTHMONTH> `
  -BirthDay <BIRTHDAY>

Use the following PowerShell cmdlet to remove date of birth:

Remove-SAVerifiedIdEnrollment `
  -ClearBirthYear
  -ClearBirthMonthAndDay

Note

The date of birth value is stored in Active Directory as an encrypted hash, not the actual date.

Authenticating with Specops Verified ID

If you are using the Specops:ID mobile app to authenticate, make sure it is installed on your mobile device.

After entering your username and password, choose Specops Verified ID as the identity service.
A QR code is displayed in Specops Authentication Web, depending on how you verify:
- If authenticating through the Specops:ID mobile app, scan the QR code using Specops:ID and tap Continue.
- If authenticating through a web browser on your computer, scan the QR code with your mobile device and open the link in your mobile web browser.
- If authenticating through a web browser on your mobile device, use Tap to start verification.
Note

Both web browser options are available only when the verification level is Low. At Medium and High, only the Specops:ID app option is available.
Follow the instructions to scan your ID document with the camera.
To verify liveness, follow the instructions and take a selfie with the camera.
After successful authentication, you are logged in to your Windows account.

Troubleshooting

From a support perspective, the authentication process has five stages:

Session start
- A verification session is created for the user.
ID document capture
- The user scans an ID document.
Face capture
- The user performs a live face check.
Comparison and validation
- ID document and face results are evaluated against configured rules.
Outcome
- The authentication flow ends in success, retry, or failure.

This model helps support teams to quickly identify where users are stuck.

See the next sections for common user issues and what to check.

Users cannot start verification

Check:

Specops Verified ID is enabled for the customer
The user is in scope for the policy
Required URLs must be accessible through the firewall to enable connection to Specops Authentication (see URL Allowlists).

Many users fail at the ID document capture step

Check:

Document matching rules are not too strict for your user population
Users are scanning supported ID document types

The ID cannot meet the required verification level

After an administrator raises the required verification level, users whose ID cannot meet the new level may see:

This ID could not be verified to the level your organization requires.

The user is advised to let the app read the chip or try another ID.

Check:

The verification level configured at the top of the page. See Configuring Specops Verified ID.
- For Medium, the ID must support verification of moving security features, such as holograms. IDs without these features cannot meet this level.
- For High, the ID must have an NFC chip, and the user must use a phone that can read it. The user must allow the Specops:ID app to read the chip.
- For Medium and High, users must verify through the Specops:ID app. Web browser verification is available only at Low.

Many users fail at the face capture step

Check:

Camera quality and lighting conditions
Liveness check (active vs passive)
Face matching threshold is not set too aggressively

Users report random timeouts

Check:

Session duration expectations in user guidance
Network stability between user devices and service endpoints
Whether users pause too long between steps

Save works but verification still fails

Check:

A fresh test session was used after configuration changes
Policy assignments include the target users

Go-Live Recommendation

Before a broad rollout:

Run a pilot with a small user group
Measure failure reasons for one to two weeks
Adjust threshold and matching strictness gradually
Publish end-user guidance with screenshots and retry tips

Hand-off Information for Escalation

When escalating to technical teams, include:

Time of failure
Affected user count
Stage where failures occur (start, ID document, face, completion)
Error wording shown to users
Whether issue is tenant-wide or limited to a subset

This shortens time to resolution significantly.