> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Smart Login set up checklist Use this checklist with the following documentation to set up Smart Login with IDaaS: - [Service Provider documentation](/docs/service-provider.md) (required for Service Provider administrators only) - Entrust Identity Help (available in the Entrust Identity app) | **Step** | **Task** | **Supporting Documentation and Notes** | | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 1 | To use Smart Login, your IDaaS account must include a Smart Login entitlement. **Note:** Smart Login entitlements are assigned by your **Service Provider Administrator**. | [Service Provider documentation](/docs/service-provider.md) | | 2 | Ensure that users have a smart credential authenticator. | Assign a smart credential to users (see [Manage smart credentials](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials.md)). **Note:** Users can also add their own smart credential authenticator. See step 10. Optional: Modify the **Registration** settings to automatically enroll a smart credential for new users. See [Configure user registration](/docs/people-and-access/manage-user-policies/configure-user-registration.md). Users add their own smart credential authenticator. | | 3 | Users activate their smart credential. | | | 4 | Configure a Certificate Authority | See [Manage Certificate Authorities](/docs/authentication-and-security/manage-certificate-authorities.md). If using a Microsoft CA, you must [Create and configure a gateway](/docs/gateways/create-and-configure-a-gateway.md) and [add a directory](/docs/directories-and-provisioning/manage-directories.md). If using an Entrust Managed PKI CA, creating a gateway and directory is optional. | | 5 | Set the default digital ID configurations in the PIV template. | See [Configure smart credential definitions](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials/configure-smart-credential-definitions.md). | | 6 | Map a User Principal Name user attribute for Smart Login. | If you have synced user data with your directory (see [Trigger on-demand synchronization](/docs/directories-and-provisioning/manage-directories/manage-directory-synchronization.md#run-a-force-sync)), this is autopopulated. If you created your own custom smart credential definition, you must complete this step. See [Map a User Principal Name attribute for Smart Login](/docs/authentication-and-security/manage-smart-login/map-a-user-principal-name-attribute-for-smart-login.md). | | 7 | Map a Security ID user attribute for Smart Login to Microsoft Windows. The Security ID is a value that uniquely identifies users in your Windows environment. | IDaaS smart credentials support encoding a Security ID value into certificates associated with a user's smart credentials. When using these smart credentials to perform Windows smart card login, this value in the certificate identifies the user in Windows. See [Configure an on-premises Active directory](/docs/directories-and-provisioning/manage-directories/configure-an-on-premises-active-directory.md). | | 8 | Configure the Domain Controller to allow Smart Login. | Install Microsoft Certificate Services allows smart card login to domain clients. | | 9 | Configure the Domain Controller to trust the Certificate Authority that issues the smart credential. | See [Configure the Domain Controller to trust the issuing CA](/docs/authentication-and-security/configure-domain-controller-certificates.md). **Note:** If the IDaaS Certificate Authority resides on the Domain Controller, then this step is not required. | | 10 | Admin tasks: Configure computer login with mobile smart credentials through Bluetooth for Windows | For iOS devices only: [Windows: Prepare Device Agent installation](/docs/authentication-and-security/manage-device-verification/configure-device-agent-on-windows/windows-prepare-device-agent-installation.md) [Windows: Install Device Agent](/docs/authentication-and-security/manage-device-verification/configure-device-agent-on-windows/windows-install-device-agent.md) [Enable biometric login to Windows](/docs/authentication-and-security/manage-smart-login/configure-passwordless-computer-login-through-bluetooth/windows-configure-passwordless-computer-login/windows-admin-tasks-to-configure-computer-login/enable-biometric-login-to-windows.md) [Configure the screen lock when smart credential is disconnected](/docs/authentication-and-security/manage-smart-login/configure-passwordless-computer-login-through-bluetooth/windows-configure-passwordless-computer-login/windows-admin-tasks-to-configure-computer-login/configure-the-screen-to-lock-when-smart-credential-is-disconnected.md) | | 11 | Admin tasks: Configure computer login with mobile smart credentials through Bluetooth for Apple Macintosh | [Mac: Prepare for Device Agent Installation](/docs/authentication-and-security/manage-device-verification/configure-device-agent-on-apple-macintosh/macos-prepare-for-device-agent-installation.md) [Mac: Install Device Agent](/docs/authentication-and-security/manage-device-verification/configure-device-agent-on-apple-macintosh/macos-install-device-agent.md) [Associate a smart credential and a Mac user](/docs/authentication-and-security/manage-smart-login/configure-passwordless-computer-login-through-bluetooth/apple-macintosh-configure-passwordless-computer-login/mac-admin-tasks-to-configure-computer-login/associate-a-smart-credential-with-a-mac-user.md) [Configure the screen to lock when a smart credential is disconnected](/docs/authentication-and-security/manage-smart-login/configure-passwordless-computer-login-through-bluetooth/apple-macintosh-configure-passwordless-computer-login/mac-admin-tasks-to-configure-computer-login/configure-the-screen-to-lock-when-a-smart-credential-is-disconnected.md) | | 12 | Admin task (optional): Configure Windows clients protected by another Smart Credential to do Smart Login. | [Configure Windows clients protected by another Credential Provider](/docs/authentication-and-security/manage-smart-login/configure-windows-clients-protected-by-another-credential-provider.md) | | 13 | Configure a resource rule to allow Smart Login | [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules/create-resource-rules.md) | | 14 | User tasks to configure Smart Login | Configure a smart credential for biometric authentication Users add their own smart credential authenticator. See the section, [Add and activate a mobile smart credential](/docs/authentication-and-security/manage-authenticators/manage-smart-credentials/add-a-smart-credential.md). Users activate their smart credential authenticator. | | 15 | Test logging in with a smart credential authenticator (user experience) | [Smart Login user experience](/docs/authentication-and-security/manage-smart-login.md) |