Confirm that you can still log in using a smart card.įor more information about smart card payload settings, see the Apple Configuration Profile Reference.įor more information about using smart card services, see the macOS Deployment Guide or open Terminal and enter man SmartCardServices.Install a smart-card configuration profile that includes 'enforceSmartCard,' as shown in the smart card-only configuration profile below.Confirm that you can log in to an administrator account using a smart card.If you’ve enabled strict certificate checks, install any root certificates or intermediates that are required.Pair a smart card to an admin user account or configure Attribute Matching.Make sure that you carefully follow these steps to ensure that users will be able to log in to the computer. This article is intended for system administrators who set security policy in enterprise environments that require smart card authentication.

macOS High Sierra 10.13.2 and later support smart card-only authentication for the mandatory use of a smart card, which disables all password-based authentication. Smart card authentication provides strong two-factor authentication in macOS Sierra and later.

Reference: Configure macOS for smart card-only authentication To avoid this, please generate an (identical) backup smart card, containing the identical certificate, which has been configured for log-in on your Mac. If you enable smart card only log-in (authentication) on your MacOS and your card get lost or damaged you may not be able to log-in again.

Mac smart card reader