Note: These emergency access methods cannot be used to access resources protected by the Cloud Authentication Service. However, you can use the online emergency access method to access resources integrated directly with the Cloud Authentication Service. If you are a SecurID Token user, you must select SecurID Token as an authentication method.
Tokencodes for Online Emergency Access
There are two types of online emergency access tokencodes. Each tokencode is an 8-character alphanumeric code generated by Authentication Manager. The user's device must be able to reach Authentication Manager on the network.
Users must have been assigned a valid, unexpired RSA SecurID Token before they receive an online emergency access tokencode. If a user's token has expired, first assign a new token and then provide temporary access.
Temporary fixed tokencode
Can be used more than once.
When the user's RSA SecurID Token is unavailable, the user must enter this tokencode with the RSA SecurID PIN. When the Authenticate app is unavailable, the user enters only the temporary fixed tokencode. A PIN might be required to view the tokencode on the mobile device, but this is not the RSA SecurID PIN.
You configure the expiration date or no expiration.
You can determine the number of tokencodes in a set.
RSA SecurID users must enter this tokencode with the RSA SecurID PIN to perform two-factor authentication. Authenticate app users enter this tokencode without a PIN. A PIN might be required to view the tokencode on the mobile device, but this is not the RSA SecurID PIN.
Is displayed on the Self-Service Console.
Users can download the set of one-time tokencodes in a file.
Users can also use the Self-Service Console to request temporary access to Authentication Manager without the assistance of an administrator. For more information, see RSA Self-Service Overview.
Online Emergency Access Tokencode Format
When online emergency access is used because the user's RSA SecurID token is unavailable, the token policy of the associated security domain determines the format of the online emergency access tokencode. For example, if the security domain’s token policy allows special characters, the online emergency access tokencode can include special characters.
This token policy is not considered when the online emergency access method is used in place of the Authenticate app.
Tokencodes for Offline Emergency Access
Offline emergency access is intended for when the user cannot access the Authentication Manager server on the network. You must provide the emergency offline authentication codes in advance, when the user has online connectivity. The system generates and downloads an offline passcode or tokencode to the user's Windows device before the user needs it. These codes cannot be sent to a user who is offline.
Note:These methods cannot be used in place of the Authenticate app.
Offline emergency access tokencode
Used when the user's RSA SecurID token or RSA SecurID Authenticate app is unavailable.
RSA SecurID users must enter the offline emergency access tokencode with the RSA SecurID PIN to perform two-factor authentication.