•  Authentication Manager 8.x
• MFA Agent 2.x for Windows
  

RSA recommends the following steps to ensure a successful deployment of a “True Passwordless” experience, extending beyond basic Windows Password Integration (WPI).

1. PKI Configuration
   • For Microsoft Entra ID, create and configure PKI following the steps in the MFA Agent Installation and Administration Guide for the installed agent version.
   • For On-Prem/Active Directory, follow steps to configure the Active Directory Certificate Authority.
   • Note: These paths differ significantly, so be mindful of the steps and details here.

2. Test Configuration (Optional but Ideal)
   1. On a handful of test machines, install the appropriate RSA MFA Agent and using the MFA Agent Installation and Administration Guide and/or MFA Agent GPO Template Guide, configure agent and passwordless settings.
   2. Following Chapter 4 of the MFA Agent Installation and Administration Guide for the installed agent version, complete the correct configuration paths for either Entra ID (see "Enabling RSA MFA Agent on Microsoft Entra ID Joined Machines”) OR for Active Directory (see “Passwordless Prerequisites”).
   3. Active Directory configuration requirements, including CA settings, are documented in Chapter 5 (Enabling the RSA MFA Agent on Active Directory and Hybrid‑Joined Machines) of the MFA Agent Installation and Administration Guide for the installed agent version.
   4. Make any necessary adjustments and retest until the agent is functioning properly before proceeding.

3. Finalize and Push Configurations
   1. Collect final global configuration settings from step 2.
   2. Using the MFA Agent Installation and Administration Guide for the installed agent version, configure a strong, complex reserve password for the MFA agent to support emergency (“break‑glass”) access scenarios. Hash the reserve password using the RSA‑provided hashing utility as documented, and securely store the hashed value in an approved password vault with restricted, auditable access. If the reserve password is checked out or used, rotate it promptly. Review and rotate the reserve password periodically in accordance with organizational security and key management policies
   3. Commit into Entra ID/GPO policies depending on environment.
   4. Push via Intune (Entra) or GPO (Active Directory).
   5. Push policies two to three weeks ahead of the agent software rollout to account for user availability (vacation time, sick time, etc.) and endpoint coverage (must be online and able to receive respective updates).
   6. Reporting/Intune checks should confirm coverage where possible.

4. Software Deployment
   • Use Intune or a preferred software management solution to deploy RSA MFA binaries.
   • Follow a phased rollout; for example, start with technical staff, expand as confidence builds, then release broadly across the organization.