RSA Product Set: ID Plus
RSA Product/Service Type: MFA Agent for Windows 
RSA Version/Condition: 2.5

Passwordless onboarding fails with the RSA ID Plus MFA Agent for Windows on local Active Directory-joined or hybrid EntraID-joined machines. When passwordless onboarding is attempted with the "RSA MFA Agent Authentication Utility", the User Event Monitor in the Cloud Administration Console shows successful authentication and validation events for the attempt, but the onboarding step fails with the following errors in the MFA Agent for Windows's log file,

 "RsaMfaAgentTestAuthentication(RSA_MFA_Agent_Authentication_Utility_for_Microsoft_Windows).log":

[E] [RsaMfaAgentAuthenticationUtility.Services.CertificateManager.SendCertificateRequest] The submission failed: Denied by Policy Module 0x80094800, The request was for a certificate template that is not supported by the Active Directory Certificate Services policy: <Certificate Template Name>.

[E] [RsaMfaAgentAuthenticationUtility.Services.CertificateManager.DownloadAndInstallCert] Certificate enrollment failed. IDisposition 2

[E] [RsaMfaAgentAuthenticationUtility.Services.AuthenticatorHelper.PerformPasswordlessAuthentication] Certificate enrollment request denied. Error: CR_DISP_DENIED.

The "Cryptography Provider Category" setting of the certificate template used for the MFA Agent for Windows Passwordless integration does not have a Crypto Provider enabled that is supported by the agent.

Modify the "Cryptography Provider Category" setting of the certificate template used for the MFA Agent for Windows Passwordless integration to allow the "Microsoft Base Smart Card Crypto Provider" option.