Oracle Cloud Infrastructure Documentation

Configuring Mobile Biometrics

Use Oracle Mobile Authenticator (OMA) to enroll and verify facial biometrics for Oracle Cloud Infrastructure (OCI) Identity and Access Management (IAM).

How Mobile Biometrics Works

Identity Assurance can use facial biometric verification after a user has authenticated. When mobile enrollment is available for an identity domain, the user can complete facial enrollment in OMA on a registered mobile device. The encrypted facial biometric representation is stored on that device rather than in the cloud biometric store used for browser enrollment.

The mobile app guides the user through the facial scan and returns the information needed for Identity Assurance verification. Biometric matching and Identity Assurance policy enforcement continue to use cloud services. Existing browser-based facial enrollment and verification remain separate supported flows, subject to the identity domain's configuration.

Assurance Role

Mobile facial biometrics supports Identity Assurance verification. It doesn't replace the user's primary sign-in method or the configured multifactor authentication factors. Unlocking a phone or OMA with the device's local biometrics isn't the same as completing an Identity Assurance facial verification.

Privacy Boundaries

With mobile enrollment, OMA retains an encrypted facial biometric representation on the registered device. Browser enrollment uses cloud-based biometric storage. Mobile enrollment doesn't mean that every verification operation takes place entirely on the device: matching and verification-policy evaluation continue to involve cloud services.

Enable Mobile Biometrics

Review the identity domain's available facial enrollment methods before directing users to enroll through OMA.

Prepare Mobile Facial Biometric Enrollment

Before you begin, complete these prerequisites:

  • Have administrative access to the identity domain that uses Identity Assurance.
  • Verify that mobile enrollment is available in your region and enabled for your identity domain.
  • Ensure users have a supported version of OMA on a compatible mobile device.
  • Review the applicable biometric consent notice and your organization's device-management requirements.
  1. Review the Identity Assurance settings for the identity domain in the Console.
  2. Confirm whether mobile facial enrollment is offered alongside browser enrollment.
  3. Communicate the supported enrollment method and device requirements to users.

Users can select the mobile enrollment option when it is made available by their identity domain. Enabling an enrollment method doesn't enroll users automatically.

Confirm the released Console setting names, permissions, and any biometric-store association procedure with engineering before publishing an administrator configuration task.

Mobile Biometric Lifecycle

Users enroll, verify, and replace an enrolled mobile device through supported Identity Assurance workflows.

Register Mobile Facial Biometrics

During enrollment, a user follows the Identity Assurance prompt to continue in OMA, registers the device as required, and completes the facial scan and liveness checks. The encrypted biometric representation is associated with that registered device.

Verify with Mobile Facial Biometrics

When Identity Assurance requests facial verification, the user continues in OMA on the enrolled device and follows the facial scan prompts. Identity Assurance validates the supported device and app security checks and returns the verification outcome.

Replace an Enrolled Mobile Device

The enrolled biometric representation isn't transferred to another phone by installing OMA. Users changing devices must remove or reset the existing mobile enrollment using their organization's supported procedure, and then enroll again. If the old device is unavailable, users should contact their identity domain administrator.

Mobile Biometric Assurance Flows

Follow the OMA enrollment and verification prompts when the mobile method is offered.

Enroll in Mobile Facial Biometrics

  1. Sign in using the configured authentication method.
  2. When Identity Assurance offers enrollment methods, select the mobile option.
  3. Follow the displayed QR code or deep link to continue in OMA.
  4. Unlock OMA and complete device registration if prompted.
  5. Follow the facial scan and liveness prompts to complete enrollment.
  6. Review the enrollment outcome shown by Identity Assurance or OMA.

Verify Your Identity in OMA

  1. When Identity Assurance requests verification, follow the QR code or deep link to OMA.
  2. Use the mobile device associated with your enrollment.
  3. Unlock OMA when prompted and complete the facial scan.
  4. Return to the requesting application and check the verification result.

Mobile Verification Workflow

  1. Initiate verification: Identity Assurance requests facial verification.
  2. Continue on the mobile device: The user opens OMA using the supplied link or QR code.
  3. Confirm device and application integrity: Supported device-registration and attestation checks are applied.
  4. Capture the face: OMA guides the user through facial capture and applicable liveness checks.
  5. Verify identity: Cloud services perform the required biometric comparison and return the outcome to Identity Assurance.
  6. Complete the request: The requesting application or workflow receives the Identity Assurance result.