Mizo Named Runner-Up in ConnectWise IT Nation PitchIT Competition 2025 Read the full press release
Mizo logo - AI agent service desk automation platform for MSPs and managed service providers

Mizo

Mizo logo - AI agent service desk automation platform for MSPs and managed service providers

Mizo

Sign In Book a demo

End-User Verification Agent

Ask AI about this doc

Pick an assistant and ask your question — we'll send it along with a link to this article.

The End-User Verification Agent confirms that the person behind a request is who they say they are before anything happens to their account. It never relies on caller ID or security questions: it sends a challenge to a device or address that was registered before the request existed.

What it does

  1. Resolves the requester against the contact record already on file in your PSA — not against whatever the requester just typed or said.
  2. Sends a challenge to the channel on record:
    • a Microsoft 365 / Entra MFA push to the device enrolled against the user’s identity, with number matching;
    • a Duo push, for clients standardized on Duo, honoring existing Duo enrollment and policies;
    • a single-use, time-limited verification link to the email address or mobile number on the contact record, when no MFA provider is enrolled.
  3. The requester confirms by approving on their enrolled device or clicking the link — typically in under thirty seconds, with no technician involved.
  4. Logs the result to the ticket.

A challenge is never sent to a number or address supplied during the conversation. A user who is locked out of their password can usually still verify, because they still have the device their authenticator app or Duo is enrolled on. An MFA push expires after roughly a minute, so the requester can trigger a new one.

What triggers it

Verification runs ahead of sensitive identity actions. Today it is mandatory before password resets, the highest-stakes action on the desk. It applies to requests that arrive by phone, email or portal. On the phone, verification also decides how much ticket detail the Phone Intake Agent reads back to a caller.

Configuration

Verification is configured by an admin in the Mizo console. Follow the End User Verification Setup Guide for the full setup, and see Require end-user verification on password reset tickets for the steps.

The MFA push uses your client’s Microsoft 365 tenant and existing MFA enrollment, and Duo verification uses the client’s existing Duo setup — Mizo doesn’t run a parallel identity system.

Human-in-the-loop vs autonomous

The challenge and the requester’s confirmation happen without a technician. The decision about what happens next is gated on the result:

  • Verified — the sensitive action can proceed. For a Microsoft 365 password reset, a technician still reviews and applies the Resolution Agent’s plan.
  • Not verified — no identity action proceeds. The request escalates to a human with what was claimed, what was attempted and what failed attached.

What’s written to the ticket

The verification method, outcome and timestamp, as structured fields rather than a free-text note. That lets the Resolution Agent gate actions on the evidence actually collected, and lets you show a client, auditor or cyber insurer exactly how a specific request was verified. Failure messages shown to the requester are generic, so they reveal nothing to someone probing an account.

Supported systems

Verification checks requesters against the contact records in your connected PSA. Verification methods depend on the client’s stack: Microsoft 365 (Entra MFA), Duo, or the one-time link fallback for clients without MFA.