RSA SecurID tokens and Authentication Manager, upgraded to 8.9 without locking anyone out.
Authentication Manager 8.9 upgrades only from 8.8, and the 8.7 line is out of primary support. We plan the route, move token and agent estates, and connect on-premises SecurID to RSA ID Plus where cloud MFA makes sense.
A hardware or software token shows a 6- or 8-digit tokencode that changes at regular intervals, and with the user's PIN added it becomes a passcode. RSA Authentication Manager checks that passcode at VPN, RADIUS and Windows logons. We upgrade Authentication Manager to 8.9, roll out RSA ID Plus and migrate tokens.
you probably need this if
Authentication Manager is on 8.7 and the team has not planned the stop at 8.8.
A hardware token renewal quote landed and nobody has priced software or passwordless options.
Network teams add RADIUS clients without telling the identity team.
terms on this pageRADIUSdefinitionAn old network sign-in protocol often used to connect reps to token or MFA servers. BeyondTrust removes it in 27.1.explained in a field note →Authentication ManagerdefinitionThe server you run yourself, on RSA hardware or as a virtual appliance. When someone types a SecurID code at the VPN, this is what checks it.explained in a field note →Access reviewdefinitionA campaign where managers or app owners confirm whether each person still needs their access. Microsoft calls it an access review; SailPoint and Saviynt call it a certification.explained in a field note →MFAdefinitionMulti-factor authentication. On top of the password you prove it's you a second way, usually with an app prompt or a security key.explained in a field note →
Every authentication agent and RADIUS client on one list, with its owner and whether it passed our sign-in test
An upgrade plan that walks from the build you run today to 8.9, patch by patch
Upgrade runbook with timed rehearsal results on a replica
+ 2 more documents
who does it
RSA Authentication Manager engineerRSA ID Plus integration engineerRADIUS and network authentication engineer
ID Plus Administrator Path
ID Plus Implementer Path
Jan 2026Authentication Manager 8.9 Released January 2026. Upgrades only from 8.8. Adds passwordless sign-in when acting as a secure proxy for the Cloud Access Service. Admin SDK qualified on JDK 11 and 17.
today · Nov 09, 2026
no date yet8.9 Patch 2 Hotfix 1Latest build we found, with an updated Web Tier Server. RSA recommends upgrading at the earliest opportunity.
no date yetEnd of primary support by version8.7 SP1 is already past primary support, which ended June 2026. 8.7 SP2 gets there in January 2027 and 8.8 in April 2028. Extended support levels run past each date, so check which one your contract actually covers.
the story · rsa securid estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your RSA SecurID estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · rsa securid estate3 open
openAuthentication Manager is on 8.7 and the team has not planned the stop at 8.8.
recurringA hardware token renewal quote landed and nobody has priced software or passwordless options.
blockedNetwork teams add RADIUS clients without telling the identity team.
exposure
Authentication Manager upgrades…RSA ID Plus rolloutToken and authenticator migrationAgent and RADIUS integrationRSA Governance & Lifecycle support
startrehearsehandover
Estate inventory
Upgrade route
Rehearsal and testing
Cut-over and authenticator…
we are here
ready to hand over
They're on a supported build now, and so is the JDK under the SDK script.
Finance renews hardware only for the people who actually need it.
Every authentication agent and RADIUS client on one list, with its owner and whether it…
An upgrade plan that walks from the build you run today to 8.9, patch by patch
chapter 01 · where it hurts
Why teams reach out
Authentication Manager is on 8.7 and the team has not planned the stop at 8.8.
A hardware token renewal quote landed and nobody has priced software or passwordless options.
Network teams add RADIUS clients without telling the identity team.
chapter 02 · what we change
How we solve it
Authentication Manager upgrades to 8.9
RSA ID Plus rollout
Token and authenticator migration
Agent and RADIUS integration
RSA Governance & Lifecycle support
chapter 03 · how it runs
Our approach
Estate inventory
Upgrade route
Rehearsal and testing
Cut-over and authenticator plan
chapter 04 · where you end up
What changes
They're on a supported build now, and so is the JDK under the SDK script.
Finance renews hardware only for the people who actually need it.
Every authentication agent and RADIUS client on one list, with its owner and whether it passed our sign-in test
An upgrade plan that walks from the build you run today to 8.9, patch by patch
what we do
Our RSA SecurID work
5 kinds of RSA SecurID work, each run by engineers who have done it on live tenants.
A route from 8.7 or 8.8 to 8.9, with primary and replica appliances patched in order, agents and RADIUS clients tested, and the Web Tier updated.
Cloud or hybrid MFA on RSA ID Plus, with the RSA Authenticator app, hardware tokens where policy requires them, and Authentication Manager acting as a secure proxy.
Hardware token renewals or a move to software and passwordless authenticators, planned by user group so nobody is left without a working factor.
Windows, Unix, VPN and network device integrations inventoried and retested, with RADIUS client settings documented per device.
Patching, collector tuning and review campaigns on Governance & Lifecycle 8.0, with application onboarding where coverage is thin.
capability 01 / 05in production
Authentication Manager upgrades to 8.9
A route from 8.7 or 8.8 to 8.9, with primary and replica appliances patched in order, agents and RADIUS clients tested, and the Web Tier updated.
Cloud or hybrid MFA on RSA ID Plus, with the RSA Authenticator app, hardware tokens where policy requires them, and Authentication Manager acting as a secure proxy.
We pieced these together from RSA SecurID situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Authentication Manager 8.7 SP1, out of primary support since June
composite · not a client story
Beforethe situation
A primary and three replicas run 8.7 SP1. Primary support ended in June 2026, the VPN depends on RADIUS, and an Admin SDK script syncs users from a legacy directory.
What we dothe work
We inventory RADIUS clients and agents, test the SDK script against the JDK versions 8.9 supports, then upgrade a replica in a test network to 8.8 and on to 8.9. Production follows the same steps, replicas after the primary.
Afterwhere you end up
They're on a supported build now, and so is the JDK under the SDK script. Nobody on the VPN lost authentication while it happened.
case file 02
Thousands of hardware tokens expiring next spring
composite · not a client story
Beforethe situation
Most users carry SID700 tokens, and they expire within six months. Finance is asking whether to renew them. Some people work on sites where phones aren't allowed, so an app-only answer won't do.
What we dothe work
We group users by where and how they work, propose RSA Authenticator or passwordless for groups that can use phones and hardware tokens for those that can't, and pilot each group before the expiry date.
Afterwhere you end up
Finance renews hardware only for the people who actually need it. Everyone else is on the app or passwordless before their old token stops working.
We don't start a step until the last one has produced something you can check.
step 01
Estate inventory
We write down every appliance and replica with its build number. Then come the authentication agents, RADIUS clients, token types and expiry dates, plus any custom integration someone built on the Admin SDK. Miss one RADIUS client here and it can show up later as an outage.
step 02
Upgrade route
A step plan from your current build to 8.8 and then 8.9, with the patch and Web Tier order and the replica sequence written down.
step 03
Rehearsal and testing
We run each step on a replica in a test network first, test sign-ins for VPN, Windows and RADIUS devices, and write down how long everything took.
step 04
Cut-over and authenticator plan
Production upgrade with your team, then a token renewal or ID Plus rollout planned by user group, with the help desk briefed beforehand.
ai on rsa securid
Where AI fits on RSA SecurID, and where it needs guardrails.
The Authentication Manager 8.9 announcement from RSA covers passwordless support, JDK 17 for the Admin SDK and library upgrades. It has no AI or MCP features. Where AI helps is the two-step move from 8.7 through 8.8, inventorying agents and RADIUS clients, converting old Admin SDK scripts and triaging authentication logs along the way.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
RSA SecurIDdoes the work
RSA doesn't currently offer an MCP server for Authentication Manager, so agents use the Admin SDK or REST interfaces through a dedicated administrator with a limited role, with full logging. Token assignments and policy changes wait for a person to approve them.
Admin SDK script updates
8.9 qualifies the Admin SDK on JDK 11 and 17 and deprecates Java 8. Old SDK scripts often carry Java 8 dependencies that nobody remembers adding. We have an AI coding assistant find them and draft the updates, and engineers test against a replica before production is touched.
Agent and RADIUS client inventory
Many estates have authentication agents and RADIUS clients nobody ever put on a list. We have an assistant merge the exports and logs into a single inventory with owners and versions. Your team then confirms it, device by device.
Authentication log triage
Expect a burst of failed authentications across many devices after each upgrade step. Sorting them by hand is slow. We'd have an agent group the failures by client and by cause, so engineers fix the real problems first.
architecture
What sits between a SecurID token and the app someone is trying to open
People sign in with the RSA Authenticator app or a hardware token. VPNs and network devices pass the passcode to Authentication Manager over RADIUS. Cloud apps go through Entra ID or Okta to RSA ID Plus, and for hybrid sign-in Authentication Manager sits in the middle as a secure proxy.
use cases
Typical RSA SecurID projects
The work teams usually bring us, and the platforms RSA SecurID has to talk to while we do it.
RSA-01You're still on Authentication Manager 8.7, with primary support over or nearly over
common request
RSA-02Hardware tokens expire soon, and finance wants to know if renewing them is worth it
common request
RSA-03VPN and network devices authenticate over RADIUS and nobody has the client list
common request
RSA-04You want cloud MFA from RSA ID Plus without dropping on-premises SecurID
common request
RSA-05Reviewers rubber-stamp the access review campaigns in RSA Governance & Lifecycle
common request
These are working documents, written against your configuration, so your team can run them without us.
tests01
Every authentication agent and RADIUS client on one list, with its owner and whether it passed our sign-in test
yours to keep
plan02
An upgrade plan that walks from the build you run today to 8.9, patch by patch
yours to keep
runbook03
Upgrade runbook with timed rehearsal results on a replica
yours to keep
plan04
A token expiry report. Next to it, a plan that moves each user group to its new authenticator before its tokens run out.
yours to keep
design05
A design for connecting RSA ID Plus to Entra ID or Okta, so your identity team knows how sign-in will flow.
yours to keep
talent and delivery · rsa securid
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
certifications our engineers hold
ID Plus Administrator PathRSA
ID Plus Implementer PathRSA
Governance & Lifecycle Implementer PathRSA
roles we staff
RSA Authentication Manager engineer
RSA ID Plus integration engineer
RADIUS and network authentication engineer
RSA Governance & Lifecycle developer
MFA rollout and help desk enablement lead
due diligence · rsa securid
Questions to ask any partner, including us.
Put these to anyone bidding on your RSA SecurID work. The ones who've done it answer differently from the ones who've read about it.
Q1
Which build are we on, and how many steps does it take to reach 8.9?
8.9 only upgrades from 8.8. Any plan that assumes a single jump from 8.7 falls over at step one.
Q2
How will you find every RADIUS client before the upgrade?
Network devices are often added without the identity team knowing. A missed client means a VPN or switch outage after cut-over.
Q3
Which custom integrations use the Admin SDK, and will they run on JDK 11 or 17?
RSA qualified the 8.9 Admin SDK on JDK 11 and 17 and is phasing out Java 8. Old scripts are a common surprise.
Q4
What would you keep on Authentication Manager and what would you move to ID Plus?
Running both is normal. Where you draw the line should follow your integrations, network constraints and token policy. A product roadmap shouldn't decide it.
Q5
How will users without phones authenticate after a token migration?
Mobile apps often won't work on shop floors, in secure rooms or for contractors. The plan needs a factor for those people before the tokens expire.
01We still run RSA SecurID. What is it exactly, and how does the token work?
It's RSA's two-factor authentication product. A hardware token uses a built-in clock and a seed encoded at the factory, and a software token does the same job in an app. Authentication Manager holds the same seed, works out which tokencode the token should be showing and compares it with what the user typed. Some setups drop the PIN and pair the tokencode with a network password instead.
02Can we go straight from Authentication Manager 8.7 to 8.9?
No. RSA's 8.9 announcement says 8.9 upgrades only from 8.8. From 8.7 you upgrade to 8.8 and apply its patches, then move to 8.9. We rehearse both steps on a replica first.
03When does support end for our Authentication Manager version?
RSA's 8.9 release notes list end of primary support for 8.7 SP1 in June 2026, 8.7 SP2 in January 2027 and 8.8 in April 2028, with extended support levels after each. Check the build you run, because service packs have different dates.
04Should we move to RSA ID Plus?
It depends on what you protect. ID Plus suits cloud and SaaS apps and passwordless sign-in. Many teams keep Authentication Manager for VPN and RADIUS while adding ID Plus. We map each integration before recommending a model.
05How long will our Authentication Manager upgrade take?
The appliance work itself is usually quick. Most of the time goes into testing agents, RADIUS clients and custom integrations across the estate, so we size the job from your agent and client inventory.
06Do you also integrate SecurID with Entra ID or Okta?
Yes. We connect SecurID or ID Plus as an MFA method for Entra ID and Okta, so users keep a familiar factor while sign-in moves to a newer identity provider.
services
Related services
Projects on RSA SecurID usually end up touching one of these, so they're worth a look.
