RSA SecurID, upgraded through 8.8 to 8.9 without locking anyone out.
Authentication Manager 8.9 upgrades only from 8.8, and the 8.7 line is out of primary support. We plan the route, move token and agent estates, and connect on-premises SecurID to RSA ID Plus where cloud MFA makes sense.
Cohash upgrades and supports RSA SecurID Authentication Manager, RSA ID Plus and RSA Governance & Lifecycle.
Authentication Manager 8.9 shipped in January 2026 and upgrades only from 8.8, so estates on 8.7 need two steps. We inventory the authentication agents, RADIUS clients and tokens, and rehearse every step on a replica. Authentication Manager can also connect to ID Plus for passwordless and cloud MFA, and we set that up.
you probably need this if
Authentication Manager is on 8.7 and the team has not planned the stop at 8.8.
A hardware token renewal quote landed and nobody has priced software or passwordless options.
Network teams add RADIUS clients without telling the identity team.
Authentication agent and RADIUS client inventory with owner and test result per device
Step-by-step upgrade plan from your build to 8.9 with patch order
Upgrade runbook with timed rehearsal results on a replica
+ 2 more documents
who does it
RSA Authentication Manager engineerRSA ID Plus integration engineerRADIUS and network authentication engineer
ID Plus Administrator Path
ID Plus Implementer Path
Jan 2026Authentication Manager 8.9 Released January 2026. Upgrades only from 8.8. Adds passwordless sign-in when acting as a secure proxy for the Cloud Access Service. Admin SDK qualified on JDK 11 and 17. source ↗
today · Oct 22, 2026
no date yet8.9 Patch 2 Hotfix 1Latest build we found, with an updated Web Tier Server. RSA recommends upgrading at the earliest opportunity.source ↗
no date yetEnd of primary support by version8.7 SP1 ended June 2026. 8.7 SP2 ends January 2027. 8.8 ends April 2028. Extended support levels run later.source ↗
the story · rsa securid estate
From the first call to a setup your own team can run.
Here's what usually prompts a call about your RSA SecurID estate, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · rsa securid estate3 open
openAuthentication Manager is on 8.7 and the team has not planned the stop at 8.8.
recurringA hardware token renewal quote landed and nobody has priced software or passwordless options.
blockedNetwork teams add RADIUS clients without telling the identity team.
exposure
Authentication Manager upgrades…RSA ID Plus rolloutToken and authenticator migrationAgent and RADIUS integrationRSA Governance & Lifecycle support
startrehearsehandover
Estate inventory
Upgrade route
Rehearsal and testing
Cut-over and authenticator…
we are here
ready to hand over
Authentication runs on a supported build, the SDK script runs on a supported JDK, and…
The renewal order covers only the users who need hardware, and everyone else moves…
Authentication agent and RADIUS client inventory with owner and test result per device
Step-by-step upgrade plan from your build to 8.9 with patch order
chapter 01 · where it hurts
Why teams reach out
Authentication Manager is on 8.7 and the team has not planned the stop at 8.8.
A hardware token renewal quote landed and nobody has priced software or passwordless options.
Network teams add RADIUS clients without telling the identity team.
chapter 02 · what we change
How we solve it
Authentication Manager upgrades to 8.9
RSA ID Plus rollout
Token and authenticator migration
Agent and RADIUS integration
RSA Governance & Lifecycle support
chapter 03 · how it runs
Our approach
Estate inventory
Upgrade route
Rehearsal and testing
Cut-over and authenticator plan
chapter 04 · where you end up
What changes
Authentication runs on a supported build, the SDK script runs on a supported JDK, and the VPN never lost authentication during the change.
The renewal order covers only the users who need hardware, and everyone else moves before their token stops working.
Authentication agent and RADIUS client inventory with owner and test result per device
Step-by-step upgrade plan from your build to 8.9 with patch order
what we do
Our RSA SecurID work
5 kinds of RSA SecurID work, each run by engineers who have done it on live tenants.
A route from 8.7 or 8.8 to 8.9, with primary and replica appliances patched in order, agents and RADIUS clients tested, and the Web Tier updated.
Cloud or hybrid MFA on RSA ID Plus, with the RSA Authenticator app, hardware tokens where policy requires them, and Authentication Manager acting as a secure proxy.
Hardware token renewals or a move to software and passwordless authenticators, planned by user group so nobody is left without a working factor.
Windows, Unix, VPN and network device integrations inventoried and retested, with RADIUS client settings documented per device.
Patching, collector tuning and review campaigns on Governance & Lifecycle 8.0, with application onboarding where coverage is thin.
capability 01 / 05in production
Authentication Manager upgrades to 8.9
A route from 8.7 or 8.8 to 8.9, with primary and replica appliances patched in order, agents and RADIUS clients tested, and the Web Tier updated.
Cloud or hybrid MFA on RSA ID Plus, with the RSA Authenticator app, hardware tokens where policy requires them, and Authentication Manager acting as a secure proxy.
We pieced these together from RSA SecurID situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Authentication Manager 8.7 SP1, out of primary support since June
composite · not a client story
Beforethe situation
A primary and three replicas run 8.7 SP1. Primary support ended in June 2026, the VPN depends on RADIUS, and an Admin SDK script syncs users from a legacy directory.
What we dothe work
We inventory RADIUS clients and agents, test the SDK script against the JDK versions 8.9 supports, then upgrade a replica in a test network to 8.8 and on to 8.9. Production follows the same steps, replicas after the primary.
Afterwhere you end up
Authentication runs on a supported build, the SDK script runs on a supported JDK, and the VPN never lost authentication during the change.
case file 02
Thousands of hardware tokens expiring next spring
composite · not a client story
Beforethe situation
Most users carry SID700 tokens that expire within six months. Finance wants to know whether to renew, and some users work on sites where phones are not allowed.
What we dothe work
We group users by where and how they work, propose RSA Authenticator or passwordless for groups that can use phones and hardware tokens for those that can't, and pilot each group before the expiry date.
Afterwhere you end up
The renewal order covers only the users who need hardware, and everyone else moves before their token stops working.
We don't start a step until the last one has produced something you can check.
step 01
Estate inventory
We list appliances and replicas, build numbers, authentication agents, RADIUS clients, token types and expiry dates, and every custom integration using the Admin SDK.
step 02
Upgrade route
A step plan from your current build to 8.8 and then 8.9, with the patch and Web Tier order and the replica sequence written down.
step 03
Rehearsal and testing
We run each step on a replica in a test network first, test sign-ins for VPN, Windows and RADIUS devices, and write down how long everything took.
step 04
Cut-over and authenticator plan
Production upgrade with your team, then a token renewal or ID Plus rollout planned by user group, with the help desk briefed beforehand.
ai on rsa securid
Where AI fits on RSA SecurID, and where it needs guardrails.
The Authentication Manager 8.9 announcement from RSA covers passwordless support, JDK 17 for the Admin SDK and library upgrades. It has no AI or MCP features. Where AI helps is the two-step move from 8.7 through 8.8, inventorying agents and RADIUS clients, converting old Admin SDK scripts and triaging authentication logs along the way.
AI agentasks for data or an action
Scoped identityonly the access it needs
MCP serverthe one door into the platform
Logged, approveda person signs off on writes
RSA SecurIDdoes the work
RSA doesn't currently offer an MCP server for Authentication Manager, so agents use the Admin SDK or REST interfaces through a dedicated administrator with a limited role, with full logging. Token assignments and policy changes wait for a person to approve them.
Admin SDK script updates
8.9 qualifies the Admin SDK on JDK 11 and 17 and deprecates Java 8. Old SDK scripts often carry Java 8 dependencies that nobody remembers adding. We have an AI coding assistant find them and draft the updates, and engineers test against a replica before production is touched.
Agent and RADIUS client inventory
Many estates have authentication agents and RADIUS clients nobody ever put on a list. We have an assistant merge the exports and logs into a single inventory with owners and versions. Your team then confirms it, device by device.
Authentication log triage
Expect a burst of failed authentications across many devices after each upgrade step. Sorting them by hand is slow. We'd have an agent group the failures by client and by cause, so engineers fix the real problems first.
How RSA SecurID connects users, devices and identity providers
Users authenticate with RSA Authenticator or hardware tokens. VPNs and network devices send RADIUS requests to Authentication Manager, and cloud apps reach RSA ID Plus through Entra ID or Okta, with Authentication Manager acting as a secure proxy for hybrid sign-in.
01 · Authenticators
RSA Authenticator apppush · OTP · passwordless → VPN and network devices · passcode→ RSA ID Plus · push approve
These are working documents, written against your configuration, so your team can run them without us.
tests01
Authentication agent and RADIUS client inventory with owner and test result per device
yours to keep
plan02
Step-by-step upgrade plan from your build to 8.9 with patch order
yours to keep
runbook03
Upgrade runbook with timed rehearsal results on a replica
yours to keep
plan04
Token expiry report and authenticator migration plan by user group
yours to keep
design05
RSA ID Plus integration design for Entra ID or Okta
yours to keep
talent and delivery · rsa securid
Certified engineers, wherever you need them.
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Put these to anyone bidding on your RSA SecurID work. The ones who've done it answer differently from the ones who've read about it.
Q1
Which build are we on, and how many steps does it take to reach 8.9?
8.9 only upgrades from 8.8. Any plan that assumes a single jump from 8.7 falls over at step one.
Q2
How will you find every RADIUS client before the upgrade?
Network devices are often added without the identity team knowing. A missed client means a VPN or switch outage after cut-over.
Q3
Which custom integrations use the Admin SDK, and will they run on JDK 11 or 17?
RSA qualified the 8.9 Admin SDK on JDK 11 and 17 and is phasing out Java 8. Old scripts are a common surprise.
Q4
What would you keep on Authentication Manager and what would you move to ID Plus?
Running both is normal. Where you draw the line should follow your integrations, network constraints and token policy. A product roadmap shouldn't decide it.
Q5
How will users without phones authenticate after a token migration?
Mobile apps often won't work on shop floors, in secure rooms or for contractors. The plan needs a factor for those people before the tokens expire.
01Can we go straight from Authentication Manager 8.7 to 8.9?
No. RSA's 8.9 announcement says 8.9 upgrades only from 8.8. From 8.7 you upgrade to 8.8 and apply its patches, then move to 8.9. We rehearse both steps on a replica first.
02When does support end for our Authentication Manager version?
RSA's 8.9 release notes list end of primary support for 8.7 SP1 in June 2026, 8.7 SP2 in January 2027 and 8.8 in April 2028, with extended support levels after each. Check the build you run, because service packs have different dates.
03Should we move to RSA ID Plus?
It depends on what you protect. ID Plus suits cloud and SaaS apps and passwordless sign-in. Many teams keep Authentication Manager for VPN and RADIUS while adding ID Plus. We map each integration before recommending a model.
04How long does an Authentication Manager upgrade take?
The appliance work itself is usually quick. Most of the time goes into testing agents, RADIUS clients and custom integrations across the estate, so we size the job from your agent and client inventory.
05Do you also integrate SecurID with Entra ID or Okta?
Yes. We connect SecurID or ID Plus as an MFA method for Entra ID and Okta, so users keep a familiar factor while sign-in moves to a newer identity provider.
services
Related services
Projects on RSA SecurID usually end up touching one of these, so they're worth a look.
