RSA Product Set:  SecurID
RSA Product/Service Type:  MFA Agent For Microsoft Windows
RSA Version/Condition: 2.3.6 or above

Passwordless authentication is not directly supported for RDP in the same way as local logon.

For RDP to work with passwordless authentication:

• The source machine (from which the RDP session is initiated) must be RSA passwordless-enabled. Authentication happens locally on the source machine first. Once successful, a smart card logon certificate for the authenticated user is shared with the destination machine.
• The destination machine must have the Smart Card Credential Provider enabled (not filtered out) so that the incoming certificate can be used for authentication.
• The destination machine (to which the RDP session is sent) must either:
  • Have the same user account present locally, or
  • Be in the same ecosystem/tenant so that Windows can validate the shared Smart Card logon certificate.