Configuring the "Disable VIP Access for Mobile Credential After Migration" Policy

Products

• VIP Service

Issue/Introduction

What is the "Disable VIP Access for Mobile credential after migration" policy, and how does it impact the user migration experience?

Overview

The Disable VIP Access for Mobile credential after migration policy is a security control designed to prevent unauthorized transfers of VIP credentials to new devices. When enabled, this policy automatically disables a VIP Access credential immediately after it has been migrated to a new mobile device.

This ensures a "closed-loop" security process where the user must perform a secondary verification with an administrator or help desk before the new credential becomes active for authentication.

Environment

VIP Manager

Resolution

Policy Functionality

To ensure that users are authorized to migrate a VIP Access for Mobile credential to a new device, set this policy to Yes.

Once the migration is complete:

1. The credential on the new device is placed in a Disabled state.

2. The user is blocked from using the credential for any protected logins.

3. The user must contact your organization's Support help desk or an administrator to authenticate their identity.

4. An administrator must manually Enable the credential in the VIP Manager console.

Customizing End-User Notifications

If this option is set to Yes, administrators can customize the messaging that users see during the transition. It is critical to include specific contact information (such as a phone number or internal portal link) so users know how to request activation.

• End-user notification before migration: * Where it appears: On the existing (old) device when the user initiates the migration process.

  • Character Limit: Maximum 256 characters.

  • Best Practice: Inform the user that their credential will be temporarily disabled and provide the help desk contact details.

• End-user notification after migration: * Where it appears: On the new device if the user attempts to use the migrated credential before it has been enabled.

  • Character Limit: Maximum 256 characters.

  • Best Practice: Clearly state that the credential is currently disabled for security reasons and provide instructions on how to complete the identity verification process.