Summary

Apple has introduced changes to the macOS 27 authentication framework which affect the RSA MFA Agent's integration with the macOS login and unlock authentication flows. 

As a result, there are two distinct issues:

1. The RSA MFA Agent will not be invoked during the initial login process.
2. The RSA MFA Agent will no longer allow users to authenticate if invoked during future lock/unlock processes.
   Users for which the Agent is configured to be disabled for lock/unlock flows are not impacted.

For fresh installations of the RSA MFA Agent on macOS 27, RSA MFA authentication during the initial login process is not affected. However, RSA MFA authentication at the lock/unlock process is affected.

Affected Products

• RSA MFA Agent 2.1.2 for macOS and earlier versions

Recommendation

For the 1st issue (initial login), RSA recommends the following:

• Customers who will upgrade or have already upgraded to macOS 27 and have the RSA MFA Agent installed must follow the instructions in Restore RSA MFA Agent Plugin to re-enable RSA MFA authentication at login.

For the 2nd issue (lock/unlock), RSA recommends the following:

• Users must disable the use of the Agent for the lock/unlock flow by following the below steps:

1. 1. Launch the RSA Control Center and navigate to the Configuration tab.
   2. Select the Unlock using macOS Authentication Only checkbox.
   3. Click Update.
   4. Log out of the current user session for the configuration changes to take effect.

If a user is locked out of the device at the lock/unlock flow, the issue can be resolved by rebooting the device, going through the standard initial login flow, and then applying the above steps. A permanent resolution to the 2nd issue will be provided with the release of the upcoming RSA MFA Agent 2.1.3 for macOS.