After macOS is updated, users may not see the RSA MFA challenge at login and unlock.

When macOS is updated, the OS automatically removes the MFA Agent plugin entry from the system.login.console and/or system.login.screensaver. Due to this, users are not challenged by MFA authentication at login and/or unlock.
macOS also removes third-party plugins of MFA vendors if there are changes that could affect the relevant authorization databases. 

If you are following this procedure after upgrade to macOS 27, see the Note for macOS 27 Users section below.

Prerequisites (to be executed by an administrator):

1. Copy RestoreRSAPlugin.sh to the /Library/Application Support/RSA MFA Agent/ folder using the following command:

sudo cp RestoreRSAPlugin.sh /Library/Application\ Support/RSA\ MFA\ Agent/

2. Make sure the file permission is set to 751 using the following command:

sudo chmod 751 /Library/Application\ Support/RSA\ MFA\ Agent/RestoreRSAPlugin.sh  

About the script:

This script verifies and restores the RSA MFA Agent plugin. If the plugin is removed during the macOS update, then this script can be executed either with no arguments or with “EnableMonitor” or “DisableMonitor” arguments. 

1. No arguments:
Executing the script without arguments verifies and restores the RSA MFA Agent plugin on the existing macOS version (it will not monitor for RSA MFA Agent plugin removal for future macOS updates). After executing this command, restart the machine to enable the plugin to function at the console and screensaver. 

Command:

sudo /Library/Application\ Support/RSA\ MFA\ Agent/RestoreRSAPlugin.sh 

Note: This option does not monitor the RSA MFA Agent plugin.

2. EnableMonitor:
Executing the script with “EnableMonitor” as an argument adds the daemon service to monitor the RSA MFA Agent plugin after the macOS restarts. This adds the RSA MFA Agent plugin as per the Agent configuration and performs machine restart to enable the plugin to function. Additionally, if the plugin is already removed, then this option restores it when the machine is restarted.

Command:

sudo /Library/Application\ Support/RSA\ MFA\ Agent/RestoreRSAPlugin.sh EnableMonitor

3. DisableMonitor:
Executing the script with “DisableMonitor” removes the daemon service to stop monitoring for the RSA MFA Agent plugin.

Command:

sudo /Library/Application\ Support/RSA\ MFA\ Agent/RestoreRSAPlugin.sh DisableMonitor

Note: macOS updates must be verified on a test machine before users upgrade their systems. During the verification process, if the RSA MFA Agent plugin is removed, administrators have to enable the plugin to make sure that the latest macOS updates do not impact the Agent login. Based on the infrastructure management, administrators can utilize different modes provided by the RestoreRSAPlugin.sh script, such as to enable the RSA MFA Agent plugin one time or add a daemon service to monitor the RSA MFA Agent plugin for future macOS updates.

It is strongly recommended that the macOS update is validated on a test machine to verify if the plugin is being removed before it is pushed to end-user computers. If the plugin is removed, then enable it with the script and verify if the Agent functions accurately.

Note for macOS 27 Users

1. Launch the RSA Control Center and navigate to the Configuration tab.
2. Select the Unlock using macOS Authentication Only checkbox.
3. Click Update.
4. Log out of the current user session for the configuration changes to take effect.

After enabling this option, macOS unlock operations will use the native macOS authentication mechanism instead of RSA MFA authentication.