Deployment Scenarios

1Kosmos Credential Provider intercepts Run As and UAC elevation prompts, requiring MFA before elevated access is granted. From v2.0.7.0, passwordless authentication is supported for these scenarios.

---

Overview

The 1Kosmos Credential Provider is installed on workstations and servers. Once installed, it intercepts Windows authentication events, login, unlock, Run As, UAC, and RDP, and enforces MFA according to the Adaptive Auth Journey assigned to the user.

The behaviour of the agent varies depending on the environment it is deployed in. The pages in this section document each supported deployment scenario, its prerequisites, and any configuration specific to that environment.

Deployment Scenarios

Scenario	Description
Standard Domain-Joined Workstations	The baseline deployment - Active Directory domain-joined machines with full network connectivity to the 1Kosmos tenant
RDP / Remote Desktop	Incoming and outgoing RDP sessions, covering both configurations where the agent is installed on the remote server and where it is not
Shared Workstations / CyberArk PAM	Shared device environments using CyberArk Privileged Access Management for shared account authentication via 1Key
Offline / Disconnected Environments	Workstations that operate without network connectivity, using cached credentials for authentication
Local Accounts / Break-Glass	Configuration for local (non-domain) accounts and emergency break-glass access when MFA cannot be completed
Entra ID Joined Machines	Support for Microsoft Entra ID joined machines - currently on the product roadmap

---

General Prerequisites

The following prerequisites apply across all deployment scenarios unless explicitly noted otherwise on a scenario-specific page.

Prerequisite	Requirement
Operating system	Windows 10 (1903+), Windows 11, Windows Server 2016, 2019, 2022
Agent version	See individual scenario pages for version-specific requirements
Installation directory	C:\Program Files\1Kosmos\BlockIDCredentialProvider
Log directory	C:\Program Files\1Kosmos\BlockIDCredentialProvider\Logs
Network connectivity	Required for all online authentication methods
AdminX access	Administrator access to the 1Kosmos AdminX portal for journey configuration
Active Directory	Required for domain-joined scenarios; local account scenarios operate independently of AD

Installation and system prerequisites are covered in detail in Installation. This section assumes the agent is already installed and the base configuration is complete.