Verify ECE identity-provider key mapping before enrolling cameras

Make successful identity-provider key verification a release gate before enrolling cameras into ECE.

Source facts

Verkada’s ECE enablement workflow requires OIDC single sign-on before camera enrollment. The documented identity providers are Okta, Microsoft Entra ID, and Google Workspace. The administrator generates and downloads an encryption key, maps it into the identity provider, logs out and tests the mapping, and then selects devices for enrollment. The guide instructs administrators to generate the key once and avoid regenerating it after verification. It also calls for current Command mobile apps before deployment.

Source: Verkada Help — Enable Enterprise Controlled Encryption.

Applicability

Applies to the documented Enterprise Controlled Encryption onboarding sequence. Identity-provider field mapping is provider-specific; this article is a rollout decision guide rather than a replacement for the vendor’s setup instructions.

DSE recommendation

DSE recommends treating the logout-and-test stage as a release gate before enrolling cameras. Identify the identity owner, video owner, and protected storage location for the downloaded key. Pilot with representative users and supported mobile clients, including newly provisioned identities. Resolve any mapping failure before expanding enrollment. Make changes through an approved procedure and keep key material out of tickets, screenshots, and article examples. Coordinate recovery arrangements separately from routine enrollment.

Verification

Use the vendor’s verification step with an authorized pilot account and confirm the expected user receives the required mapping. Record a pass/fail result without recording the secret. Validate the selected pilot device and mobile workflow before extending enrollment, and seek vendor guidance rather than repeatedly generating replacement keys.

Official reference

Verkada Help — Enable Enterprise Controlled Encryption. Reviewed October 15, 2026.