---
title: "Enable Axiad Confirm"
slug: "enable-axiad-confirm"
tags: ["Axiad Confirm"]
updated: 2026-07-21T14:23:18Z
published: 2026-07-21T14:23:18Z
canonical: "docs.axiad.com/enable-axiad-confirm"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.axiad.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Enable Axiad Confirm

To enable Axiad Confirm, you must complete the following steps in Axiad Conductor and the Identity Provider.

Add the properties below in the UCMS config.properties to support the Axiad confirm feature. This will be required when deploying “UCMS 4.26” and “UP 2.21” versions.

## Update Role Management

Update [Role Management](/v1/docs/grant-privileges) in UCMS as follows:

1. Grant **Read** and **Modify** privileges to screens / functionalities to the operator role
  1. `Configuration: Verification Server List`
  2. `Configuration: Verification Servers - Create/Edit Jumio Verification Server`

![](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/image(42).png)

1. Grant **Allow** **access privileges** to REST APIs to the **UCMS_API** role
  1. `POST /api/v2/users/{uid}/verification` This allows UP or an external system to initiate the Identity Verification process
  2. `GET /api/v2/users/{uid}/verification/status` This allows UP or an external system to retrieve the Identity Verification status
  3. `GET /api/v3/users/IdVerification/reports` This allows UP or an external system to display the transaction consumption
  4. Reset User ID Verification Status: allows to delete a user’s transactions in Jumio
  5. GET /api/v2/users/{uid}/password: allows to reset AD password

> [!NOTE]
> Note
> 
> These privileges can also be given to a custom API role if you would like to integrate your own tool with Axiad Confirm

> [!TIP]
> Upcoming
> 
> API documentation for these APIs will be part of the next Confirm release

1. Grant **additional privileges** to other actions to the required roles
  1. `IdConfirmationStatus` This enables the help desk operator to see an additional column in the Unified Portal (UP)with the ID Confirmation status
  2. `ConfirmID` This enables the help desk operator to initiate an Identity Verification for users, with the “Confirm ID” action in UP
  3. DeleteConfirmId

![](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/Image 2-24-26 at 11.21 AM.png)

## Integrate Identity Provider

Currently, Axiad Confirm supports only Microsoft Entra ID. Connect Entra ID to Axiad Conductor using the [integration guides](/v1/docs/int-microsoft-entra-id).

## Create / Update SCIM User Source

Axiad Confirm uses a few attributes to send emails to users and to define from which country and state they are for default selection of the government-issued ID. In the next release, the onboard date will allow you to automatically send an email to the user on their first day.

1. Create or edit an existing [SCIM User Source](/v1/docs/scim-user-source)
2. Add the following as **Custom Attributes**:

| Attribute Key | Display Name | Permission | Mandatory / Optional |
| --- | --- | --- | --- |
| addresses[type eq "home"].country | Country | Read | Optional - Default country can be configured in Conductor settings |
| addresses[type eq "home"].region | State | Read | Optional |
| emails[type eq "home"].value | Recovery Email | Read | Optional |

## Update Entra ID Attribute Mapping

1. In the Microsoft Entra admin center, navigate to the **Axiad Conductor Enterprise application**
2. In the **Manage** menu, click **Provision**
3. In the **Manage** menu, click on **Attribute mapping (Preview)**
4. Click **Provision Azure Active Directory Users**
5. Click **Show advanced options**
6. Click **Edit attribute list for <Axiad Conductor Enterprise Application>**
7. Add the following attributes at the bottom of the page:

| Name | Type | Primary Key? | Required? | Multi-value? | Exact case? | API Expression | Referenced Object Attribute |
| --- | --- | --- | --- | --- | --- | --- | --- |
| addresses[type eq "home"].region | String | Unchecked | Unchecked | Unchecked | Unchecked | Empty | 0 selected |
| addresses[type eq "home"].country | String | Unchecked | Unchecked | Unchecked | Unchecked | Empty | 0 selected |
| emails[type eq "home"].value | String | Unchecked | Unchecked | Unchecked | Unchecked | Empty | 0 selected |

1. **Save** the settings
2. Click **Add New Mapping**

> [!WARNING]
> Required
> 
> Only provisioning the **country** attribute is mandatory, but Axiad recommends provisioning all attributes if possible

| Mapping Type | Source Attribute | Default value if null (optional) | Target Attribute | Match objects using this attribute | Matching precendence | Apply this mapping |
| --- | --- | --- | --- | --- | --- | --- |
| Direct | <Attribute that contains user’s state> | Empty | addresses[type eq "home"].region | No | Empty | Always |
| Direct | <Attribute that contains user’s country> | Empty | addresses[type eq "home"].country | No | Empty | Always |
| Direct | <Attribute that contains user’s personal email> | Empty | emails[type eq "home"].value | No | Empty | Always |
| Direct | <Attribute that contains user’s start date> | Empty | urn:ietf:params:scim:schemas:extension:CustomExtensionName:2.0:User:onboardDate | No | Empty | Always |

## Active Directory Attributes Mapping

Reset the user’s AD password once verification is successful. Once verification is successful in Axiad-Confirm, the user's password will be reset in AD.

1. ### **Configure UCMS to Use AD Hostname**

In UCMS → AD Configuration, replace the IP address with the AD hostname.

| Before | After |
| --- | --- |
| `65.0.213.35` | `SRV01DC.domain.local` |

1. ### **Update UCMS Server Hosts File**

### **a. Get the AD server hostname by running** `nslookup` **on the AD server:**

`C:\Users\Administrator&gt;nslookup Default Server: srv01dc.domain.local Address: 10.0.1.216`

`b.&nbsp;`Add the hostname entry to the UCMS server:

bash

`sudo nano /etc/hosts`

Add the following entry:

`65.0.213.35 SRV01DC.domain.local`

1. ### **Export and Import AD Certificate**
  1. Export the certificate from AD (run on UCMS server or any machine with OpenSSL): bash

```plaintext
openssl s_client -connect SRV01DC.domain.local:636 -showcerts </dev/null | \ sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > dc-cert.cer
```

1. Verify the certificate was exported: bash

`cat dc-cert.cer`

c**.** Import the certificate into the Java keystore:

bash

```plaintext
keytool -import -trustcacerts -alias dc-cert \ -file dc-cert.cer \ -keystore /opt/java/jre/lib/security/cacerts
```

> **Note:** The keystore path may vary depending on your Java installation.

1. Restart UCMS service.

1. ### **Delegate Password Reset Permissions in AD**

The User Bind DN account configured in UCMS must have permission to reset user passwords in AD.

**On the Domain Controller:**

1. Open **Active Directory Users and Computers**
2. Right-click on the domain → Select **Delegate Control**
3. Select the User Bind DN account used in UCMS AD configuration
4. Grant the following permission:
  - ✅ **Reset user passwords and force password change at next logon**
5. Complete the wizard

### **Note:**

1. 4.26.1/2.21 supports 3-letter country codes.
2. In the demo environment, when Confirm Drop1 is upgraded to Confirm Drop2, edit Confirm workflows and configure the Confirm Outcome step as per Drop2 changes.

## Create Verification Server

A verification server is required to connect to the identity verification service used by Axiad Confirm. Following the configuration steps in the [Create a Verification Server guide](/v1/docs/create-new-verification-server).

## Create / Update Credential Workflow

1. Create or edit a [Credential Workflow](/v1/docs/credential-workflow)
2. In the **Configure Workflow Steps** section, select **Confirm Outcome** in the left-side menu
3. Select the **Identity Provider** from the dropdown
4. Click **Done**
5. **Save** the configuration

![](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/Confirm8.png)

## Optional: Update Notification Template

You can modify the content in the emails sent to users during the Axiad Confirm process.

1. In the Axiad Conductor Operator Portal, navigate to **Configuration > Notifications > Notification Templates**
2. Locate the **Mail to user about Identity Verification** template and click the **Edit** icon

![](https://cdn.document360.io/eaa8d9cb-3eef-4690-8447-5bcaa4f4afb2/Images/Documentation/image-1751056936467.png)

1. Make any preferred changes and **Save** the template