HindentechQA and UAT

Verified ID test hub

Every way a person proves who they are with Face Check, gets a one-time pass and creates a passkey in Microsoft Authenticator. Pick a path, open its start page, and record each test case by its ID.

Which path?
  • Has a Verified Employee card and calls for help: Path 1. Recovers alone: Path 2.
  • New phone, no card: Path 3. Not started yet: Path 4, often sent by Path 5.
  • The card, the Face Check and the passkey always happen on the phone; a computer can start every path and hands off by QR.
  • First run? Check your account and phone against Before your first run.
1

Path 1: Help desk call

A caller who lost their sign-in phones the help desk. The agent starts a verification, the caller passes Face Check on their own phone, and the agent releases the pass to that phone without ever seeing it.

Who
Two testers: an agent and a caller
Devices
Agent on a computer; caller on a phone (or computer plus phone)
Needs
Caller has a Verified Employee card. Agent has the HelpDesk.Agent role.
Agent console helpdesk.hindentech.com/ Agent signs in here Caller page id.hindentech.com/ Caller types the 6-digit code

Happy path

  1. Agent signs in, enters the caller's work email and starts the verification. A 6-digit code, a link and a "Say this" script appear.
  2. Caller opens the caller page on the phone and types the code (or opens the link the agent sent).
  3. Caller taps Open in Microsoft Authenticator, shares the Verified Employee card, takes the Face Check selfie and swipes back.
  4. Caller page shows Face Check passed; the agent's timeline shows each step with the Face Check score.
  5. Agent presses Release pass to the caller's phone. Caller taps Show my one-time pass: pass, countdown and Copy pass.
  6. Caller adds the work account in Authenticator with the pass and creates the passkey. Within about 15 seconds the agent sees Passkey registered.
Test cases (14)
IDDevicesWhat to doExpected
HD-01Agent: computer. Caller: phoneHappy path aboveEach step as listed; the pass never appears on the agent page; timeline ends with Passkey registered
HD-02Agent: computer. Caller: phoneAgent sends the link with the code; caller opens itCode is pre-filled; rest as HD-01
HD-03Agent: computer. Caller: computer + phoneCaller types the code on a computer, opens "On a computer? Scan this with Authenticator" and scans the QR from inside AuthenticatorFace Check on the phone; the pass appears on the caller's computer after release
HD-04Agent: computer. Caller: phoneAfter the Face Check passes, agent presses Show pass here to read outPass shows on the agent page once; caller page says it was already shown
HD-05Caller: phoneReload the caller page after the pass was shown"Your pass was already shown"
HD-06Caller: phoneType a wrong code"That code is not valid. Ask the agent for a new one." More than 10 tries a minute from one network is refused
HD-07Caller: phoneWait more than 5 minutes after the agent startsCode or request has expired; agent starts a new one
HD-08Caller: two phonesEnter the same code on a second phoneSecond phone refused; only the first browser can reveal the pass
HD-09Caller: phoneFace Check with a different face, or the face covered"The Face Check did not pass. Tell the agent." No release button for the agent
HD-10Caller: phoneShare another employee's Verified Employee cardRefused: the card must belong to the account the agent entered
HD-11Agent: computerStart a verification for an email that does not exist or is disabled"No eligible account was found for that user principal name."
HD-12Agent + callerCaller not in VID-Pilot-Users; pass the Face Check and releasePass refused with a clear error on the agent page
HD-13Agent + callerCaller holds a privileged directory rolePass refused: "use the manual admin recovery process"
HD-14Agent: computerSign in without the HelpDesk.Agent roleAccess denied; no console
2

Path 2: Self-service recovery with a card

An employee who still has the Verified Employee card in Authenticator (passkey lost, or phone restored from an Authenticator backup) recovers alone: Face Check, one-time pass, passkey.

Who
One tester
Devices
Phone, or a computer that hands off to the phone by QR
Needs
A Verified Employee card in Authenticator.
Recovery start recover.hindentech.com/ Keep "I still have my Verified Employee card"

Happy path

  1. Open recovery, keep I still have my Verified Employee card, enter the work email, Continue.
  2. Start Face Check in Authenticator: share the card, take the selfie, swipe back. The page moves on by itself.
  3. Show my one-time pass: shown once, with a 60-minute countdown and Copy pass.
  4. In Authenticator: +, Work or school account, Sign in, the work email, "Use your Temporary Access Pass instead", paste, Create a passkey.
  5. Back in the browser: Your passkey is registered, with the phone setting that makes sign-in offer it.
  6. From a computer (SR-02): scan the Continue on your phone QR, press Continue on this phone. The computer becomes a live progress page that never shows the pass.
Test cases (14)
IDDevicesWhat to doExpected
SR-01PhoneHappy path on the phoneFinish screen within about 15 seconds of creating the passkey
SR-02Computer + phoneStart on the computer, scan the QR, finish on the phoneComputer shows live progress; all three steps turn green; pass never shown there
SR-03Computer + phoneUse the "No camera?" link under the QR instead of scanningSame as SR-02
SR-04Computer + 2 phonesScan the same QR with a second phone after the first continued"This code has expired or was already used"
SR-05Computer + phoneWait 10 minutes before scanningCode expired; reloading the computer page gives a new one
SR-06Computer + phoneOpen the hand-off link in a mail or chat preview onlyNothing moves; the computer keeps control
SR-07PhoneAuthenticator does not open from the button"Authenticator did not open?" shows a QR to scan from inside Authenticator
SR-08PhoneFail the Face Check (wrong face, poor light)Failure banner and retry; after 3 tries the page points to the help desk
SR-09PhoneAfter the pass, tap "I lost the pass or it expired, get a new one"Fresh Face Check, then a second pass; a third is refused
SR-10PhoneTap "I've created my passkey, finish" before it is detectedJourney finishes as self-confirmed
SR-11PhoneNo card: tap "No Verified Employee card in Authenticator? Email me a setup link instead""Check your personal email"; continue in Path 3
SR-12PhoneUse an email that does not existLooks the same as a real account; Face Check can never pass; no email sent
SR-13PhoneStart 4 times within 10 minutes for one accountFourth: "Too many attempts for this account"
SR-14Phone, other browserOpen the journey address (/j/...) in another browser or a private tab"Not available in this browser"; no journey details
3

Path 3: New phone without a card

An employee on a new phone with no card asks for a setup link. It goes to the personal email on file and works once for 24 hours. The journey adds a temporary card from the HR photo, runs Face Check, issues the pass, and offers to remove the old phone's passkey.

Who
One tester
Devices
Phone, or a computer that hands off to the phone by QR
Needs
A personal email and a profile photo on the account. Delete any Verified ID card from Authenticator first.
Recovery start recover.hindentech.com/ Choose "New phone, no card on it"

Happy path

  1. Open recovery, choose New phone, no card on it, enter the work email, Email me a setup link.
  2. "Hindentech: set up your new phone" arrives from onboarding@hindentech.com. Open Set up my new phone on the new phone.
  3. If the mail app showed a preview first, the page asks to continue on this phone; tap Continue on this phone.
  4. Confirm Authenticator is installed, Get my card in Authenticator and tap Add, Face Check with that card, then the pass and the passkey.
  5. Finish screen lists other passkeys under Remove the passkey from your old phone; Remove confirms Old passkey removed.
Test cases (11)
IDDevicesWhat to doExpected
NP-01PhoneHappy path on the phoneEmail within 2 minutes; card added; Face Check passes; passkey detected; old passkey removed
NP-02Computer + phoneOpen the emailed link on a computer, continue on the phone by QRComputer shows live progress and never the pass
NP-03PhoneOpen the link in the mail app's browser, then in Safari or ChromeSecond browser asks to continue on this phone; then the first can no longer act
NP-042 phonesAfter a pass on phone A, open the same link on phone B"This link is already in use on another device"
NP-05PhoneOpen a link older than 24 hoursLink refused; ask for a new one
NP-06PhoneRequest a link for an unknown email, or an account with no personal addressSame "Check your personal email" page; no email sent
NP-07PhoneRequest 4 links for one account within 10 minutesFourth: "Too many attempts for this account"
NP-08PhoneCheck the list on the finish screenThe new passkey is never listed; removing an old one stops it signing in
NP-09PhoneDecline the card in Authenticator"The card could not be added. Try again." with a retry button
NP-10PhoneAccount with a large profile photo (over 500 KB)Card adds normally (regression for 2026-10-29)
NP-11PhoneAccount not in VID-Pilot-Users: add the card and pass Face Check"A pass can't be issued for this account." After adding the account to the group the same link works
4

Path 4: Pre-hire onboarding

A new hire whose account HR pre-created sets up sign-in before day one, from a personal link valid for 7 days: get Authenticator, add the Pre-hire Identity card, Face Check, one-time pass, passkey.

Who
HR tester plus a new-hire tester
Devices
HR on a computer; new hire on a phone, or a computer plus phone
Needs
Test hire with a profile photo and a personal email. Links also come from Path 5.
HR onboarding page helpdesk.hindentech.com/Onboarding HR creates the new hire's link

Happy path

  1. HR signs in to the help desk, opens New hire link, enters the work email and creates the link, then sends it to the personal address.
  2. New hire opens it on the phone: "Hi <name>, let's set up your sign-in" with the steps and the work account.
  3. I have Authenticator, continue (store buttons for iPhone and Android above it).
  4. Get my card in Authenticator, tap Add, swipe back: "Card added. Welcome back."
  5. Face Check with the Pre-hire Identity card, then the pass, then the passkey, as in Path 2.
  6. Finish screen: passkey registered, the phone setting, and "Your manager has been told you are ready".
Test cases (10)
IDDevicesWhat to doExpected
PH-01HR: computer. New hire: phoneHappy path with an HR-created linkAll five steps; passkey detected
PH-02New hire: phoneUse the link from the Lifecycle Workflows welcome emailSame journey as PH-01
PH-03New hire: computer + phoneOpen the link on a computer, continue on the phone by QRComputer shows live progress; pass never shown there
PH-04New hire: phoneClose the browser after the card, open the same link againResumes at the Face Check step
PH-05New hire: phoneOpen the link in the mail app preview first, then the browser"Continue on this phone?"; nothing lost
PH-06New hire: 2 phonesAfter the pass on phone A, open the link on phone B"This link is already in use on another device"
PH-07HR: computerCreate a link for an account with no profile photoRefused: upload the HR photo first
PH-08New hire: phoneOpen a link with a changed character, or older than 7 daysLink refused; no account details shown
PH-09New hire: phoneOpen a link after the cancelled-hire workflow ranLink refused; card in Authenticator revoked
PH-10New hire: phoneAt Face Check, share someone else's Pre-hire Identity cardRefused; the card must belong to the link's account
5

Path 5: Lifecycle Workflows

Four workflows automate onboarding and offboarding around Paths 3 and 4. Scheduling is off in the test tenant, so the identity team runs each on demand for a test account and the tester checks the emails, the run history and the account.

Who
Identity team runs it; tester checks the results
Devices
Computer (Entra admin center) and the test hire's personal mailbox
Needs
Test account with department VID-POC, a manager, a personal email and a profile photo.
Entra admin center entra.microsoft.com/ ID Governance, Lifecycle workflows, the workflow, Run on demand

The workflows

  1. VID pre-hire identity proofing (3 days before hire): creates the link, emails it, emails the manager, adds the account to VID-Pilot-Users.
  2. VID day before start (1 day before hire): checks for a passkey; if none, emails a fresh link; emails the manager the outcome.
  3. VID cancelled hire (on demand): revokes links and cards, removes the account from VID-Pilot-Users, disables it.
  4. VID leaver (leave date): revokes cards and links, revokes refresh tokens, removes the account from VID-Pilot-Users.
  5. After LW-08 and LW-10, re-enable the account and add it back to VID-Pilot-Users before using it again.
Test cases (10)
IDDevicesWhat to doExpected
LW-01Identity teamRun pre-hire for a fully set-up test hireWelcome email; manager email "<name> starts soon: set-up link sent"; both tasks Completed; account in VID-Pilot-Users
LW-02Identity teamRun pre-hire for an account with no personal emailNo welcome email; manager email "Action needed" with the reason; link task Failed
LW-03Identity teamRun pre-hire for an account with no profile photoAs LW-02; reason names the missing photo
LW-04Identity teamRun pre-hire for an account with no managerWelcome email sent; no manager email; task Completed
LW-05Identity teamRun day-before for a hire who already has a passkeyManager email "<name> is ready for their first day"; nothing to the hire
LW-06Identity teamRun day-before for a hire with no passkey"Your first day is tomorrow" with a fresh link; manager told the hire has not finished
LW-07Identity teamRun day-before for a disabled account or one with no personal emailManager email "Action needed" with the reason; task Failed
LW-08Identity teamRun cancelled hire after a link was sent and a card addedOld link refused; card revoked; account disabled and out of VID-Pilot-Users
LW-09Identity teamRe-enable the cancelled account and run pre-hire againNew link works; old links stay refused
LW-10Identity teamRun leaver for an employee with a Verified Employee cardCard revoked; sessions end; account out of VID-Pilot-Users

Security checks

Run each once per path where it fits. A failure here blocks release even when the happy path works.

Checks (12)
IDCheckHow to testExpected
SEC-01The pass is shown once, to the person onlyLook for the pass on the agent page, the computer's progress page, a reloaded journey page, and in App InsightsOnly on the one screen, once
SEC-02Pass rulesUse the pass twice; and once after 60 minutesSecond and expired use both fail
SEC-03A journey address alone gives nothingCopy a /j/... or /m/... address into another browser or private window"Not available in this browser"
SEC-04The handed-off computer cannot actAfter continuing on the phone, press Back on the computer and a step buttonRefused; computer stays read-only
SEC-05No account lookupCompare a real and a made-up email on recovery start, setup link and the no-card switchIdentical pages; mail only for real accounts
SEC-06Rate limits11 wrong caller codes in a minute; 4 starts or link requests for one account in 10 minutesRefused with a wait message
SEC-07Who can get a passAccounts outside VID-Pilot-Users, privileged or disabledRefused on every path
SEC-08Links are signed and limitedChange one character; use an expired, revoked or used linkRefused with a plain message
SEC-09Card must match the accountShare someone else's card at any Face CheckRefused
SEC-10Caller hostname shows only the caller pageOpen /Onboarding and /api/onboarding/links on the caller hostnameNot found
SEC-11Onboarding API needs the automation tokenPOST to the help desk's /api/onboarding/links without a token, or as an agent401 Unauthorized
SEC-12Telemetry keeps secrets outAfter a run, check App Insights request URLsTokens, journey ids and codes show as {redacted}

Devices and accessibility

Only iPhone with Safari has been run end to end; Android has never been tested and is the top gap. Run SR-01, NP-01 and PH-01 on every phone, and SR-02 on every computer.

Device matrix (7)
IDPlatformBrowser and pathsPriority
DEV-01iPhone, iOS 17+Safari: all pathsMust (baseline, passed)
DEV-02iPhone, iOS 17+Chrome; links from Outlook and Gmail apps: SR-01, NP-01, NP-03, PH-01Must
DEV-03Android 14+, Google PixelChrome; links from Gmail and Outlook: all phone paths and the passkey provider settingMust (never tested)
DEV-04Android 14+, Samsung GalaxySamsung Internet and Chrome: all phone paths and the passkey provider settingMust (never tested)
DEV-05Windows 11Edge and Chrome: agent console, SR-02, NP-02, PH-03, HD-03Must
DEV-06macOSSafari and Chrome: SR-02, NP-02, PH-03Should
DEV-07Any phoneLargest text size, and landscape: SR-01Should
Accessibility, WCAG 2.2 AA (6)
IDCheckHow
A11Y-01VoiceOver on iPhoneSR-01 and NP-01 eyes off the screen; status changes are read out
A11Y-02TalkBack on AndroidSame as A11Y-01
A11Y-03Keyboard only on a computerTab through recovery start, the caller page and the agent console; focus always visible
A11Y-04Automated scanaxe DevTools on every page of Paths 1 to 4; no serious or critical issues
A11Y-05Zoom and reflow200% zoom, and a 320-pixel-wide window; no sideways scrolling
A11Y-06Reduced motionTurn on reduce motion; the waiting dot stops pulsing

Known limits, not defects

Deliberate proof-of-concept shortcuts or platform behaviour. Note them in the run record if they affect a test, but don't raise a defect.

Runs live in memory
A deploy or restart ends every run in progress; reopening the setup link starts that journey again
One small server
The first request after a quiet spell can take 15 to 30 seconds
Authenticator does not hand back
After Add or Share, swipe back to the browser yourself
Passkey detection polls
"Passkey registered" can take about 15 seconds; after 15 minutes only the finish button closes the step
Day-before check is yes or no
The manager email does not say at which step the hire stopped
Email only
No SMS links or Teams messages
Workflow scheduling is off
Workflows run only when the identity team runs them on demand
Neutral styling
Plain palette, proof-of-concept footer, help desk contact as an email address
Phone requirements
iPhone needs iOS 17 or later; Android needs 14 or later