Separate inventory from management
Inventory detects the PIV token and its state. Only Register turns it into a device object controlled by x.ID.
YUBIKEY LIFECYCLE MANAGEMENT
YubiKey lifecycle management: from issuance to secure replacement.
YubiKey lifecycle management covers preparation, assignment, enrollment, renewal and withdrawal of trust after loss or retirement. SYNRION x.ID by keyONE connects these steps to the accountable identity, PIV slot, CA profile and directory mapping. The workflow runs from service-team preparation through user-led certificate issuance to controlled replacement.
VALUE IN 30 SECONDS
The complete lifecycle in 30 seconds.
Separate device, identity and credential
Register, Assign and Enroll are three distinct states: managed hardware, an accountable identity and a technically issued credential.
Revocation means withdrawing trust
A revocation action withdraws trust in target systems: revoke certificates, publish the CRL and clean up affected AD/LDAP and Entra mappings.
INVENTORY · REGISTER · ASSIGN · ENROLL · OPERATE · REVOKE · DELETE
Which states does a PIV token pass through in SYNRION x.ID?
The service team can prepare many PIV tokens during predeployment. Auto-Inventory and Auto-Register support automated inventory collection and registration. Assignment, certificate issuance and eventual deprovisioning remain separate process steps.
-
01
Inventory – detect available PIV tokens
Inventory connected and previously known PIV tokens: record serial number, PIV slots, certificates, validity periods and the available key state.
-
02
Register – place the token under management
When a previously used YubiKey is first registered, it is fully reset and taken into management under the agreed integration procedure. Existing keys and certificates are deleted. Inventory alone is a read-only inventory operation without this reset.
-
03
Assign – connect the accountable identity
Assign the registered token to a verified identity, an accountable owner and, where required, a role or authorization group.
-
04
Enroll – complete credential issuance
Generate the private key in the intended PIV slot, create the Certificate Signing Request (CSR), complete the approval and CA process, and install the certificate on the token.
-
05
Operate – oversee inventory, renewal and actions
Keep track of connected tokens, current certificates, validity periods and attributes. x.ID records lifecycle actions and controls Renewal and Re-Enroll; every certificate renewal generates a new private key on the hardware.
-
06
Revoke – withdraw trust immediately
The revocation action revokes affected certificates through the CA Connector, including the reason and CRL publication. x.ID cleans up the associated certificate entries and SKI mappings in AD/LDAP, the Windows certificate store and Microsoft Entra ID.
-
07
Delete – token is present
Remove the assignment, revoke certificates, clean up directory entries, reset the Management Key and remove the token from the managed estate.
-
08
Delete – token is lost
Block the assignment and certificates, clean up directories, and remove the token together with its Management Key from management.
THE ARCHITECTURE AT A GLANCE
Withdraw trust deliberately: revoke certificates, publish the CRL and clean up AD/LDAP and Entra mappings.
TECHNICAL DEPTH
The terms behind the lifecycle.
These concepts describe different proofs and must not be collapsed into a single “key is present” signal.
- PIV attestation
- A signed attestation statement can show that a supported PIV key pair was generated by the hardware and can bind technical evidence to the issuing device. It complements identity verification; it does not replace it.
- FIDO2: device policies and Entra pre-provisioning
- Allowed YubiKey applications can be configured separately for USB and NFC, including FIDO2. PIV PIN, PUK and PIV Attestation are not FIDO2 functions. Entra FIDO2 pre-provisioning includes personal PIN handover. Tenant policy, permissions, hardware and transport must fit the deployment.
- Primary and secondary identities
- The primary identity identifies the accountable person. Secondary identities represent additional roles or contexts and remain connected to that person instead of becoming unmanaged parallel accounts.
- Policy enforcement
- x.ID checks requested CSR attributes against current data from the relevant LDAP/Entra source and its policies. Injected, unauthorized attributes must not result in issuance. Independent validation adds protection to that decision.
- Active Directory: certificate and strong mapping
- The LDAP Connector can publish the issued certificate to userCertificate and maintain a strong X509:<SKI> mapping in altSecurityIdentities. The optional Microsoft SID extension in the certificate provides another strong Microsoft mapping path.
- Microsoft Entra ID: native Azure Connector
- The native Azure Connector accesses Microsoft Entra ID directly through Microsoft Graph, without requiring AD synchronization. For Entra CBA it maintains SKI mappings in certificateUserIds. Entra FIDO2 pre-provisioning combines tenant registration with a separate personal PIN handover.
- Disruptions and resumption
- A temporarily unreachable target does not end the process: x.ID retains affected requests and automatically resumes them as soon as connectivity returns. This includes certificate revocation and directory cleanup.
- Reinitialize the device connection
- x.ID can handle recognized YubiKey driver errors during Register or deregistration by automatically reinitializing the device connection. This neither repairs damaged hardware nor provides a universal rollback guarantee.
EVIDENCE & BOUNDARIES
Actions and current state remain traceable.
The value is not a list of credentials. It is the persistent relationship between hardware, identity, intended use, policy and current lifecycle state.
Clear assignment
The security key, primary identity, secondary identities and applications remain visibly related.
Actions, certificate and current attributes
x.ID logs lifecycle actions. The current certificate and current attributes remain visible; log data can be exported for your own analysis.
Integrable operating model
On-premises Active Directory and Microsoft Entra ID use separate LDAP and Azure Connector paths; certification authorities and external systems can be added.
Reporting in the shared base module
The shared SYNRION base module provides compliance views, CBOM-capable data through APIs and prepared PCI DSS-, DORA- and BSI-oriented reports. Custom reporting and log-data export are possible. This supports assessments; it is not a compliance certification.
RELATED PRODUCT
SYNRION x.ID
Manage YubiKeys, identities, PIV certificates and FIDO2 centrally in a browser. SYNRION x.ID combines native Entra integration with cloud, on-premises or hybrid deployment through Outpost connectors. The portal also supports mobile access; the feature overview states release status and requirements.
THE NEXT CONTROLLED STEP
See your existing YubiKey process as one lifecycle.
We demonstrate issuance, operations, effective trust withdrawal and secure replacement in your workflow—including CA/CRL, AD/LDAP and Microsoft Entra ID.