Operating system requirements

Last updated: January 5, 2026

This article lists the operating systems and versions supported by the Beyond Identity Authenticator, minimum system requirements, and deployment prerequisites that IT administrators should review before rollout.

Table of Contents

• Quick Support Matrix

• Platform Details and Requirements    

  • Windows      

  • macOS      

  • iOS / iPadOS      

  • Android      

  • Linux      

• Authenticator Version Support

• Deployment Prerequisites    

  • Allow-Listed Processes      

  • Code Signing and Team Identifiers      

  • Network Requirements      

  • Security Tool Compatibility      

• Related Resources

• Changelog

Quick Support Matrix

Platform Details and Requirements

Windows

macOS

iOS / iPadOS

Android

Linux

Authenticator Version Support

Minimum supported Authenticator versions:
  - Windows, macOS / iOS /: 2.98.1 and later
  - Android: 2.98.2 and later

Tip: For latest hot-fixes and feature updates, see the Authenticator release notes.

Deployment Prerequisites

  Before deploying the Beyond Identity Authenticator at scale, administrators must   ensure that endpoint security tools, firewalls, and device policies allow the   app to run without interference.

Allow-Listed Processes (Windows and macOS)

  The following processes should be allow-listed in endpoint detection and antivirus   tools:

• BeyondIdentity.exe (Windows)  

•     BeyondIdentityViewHelper.exe (Windows)  

• BIService.exe (Windows)

• Beyond Identity.app (macOS)  

• com.beyondidentity.* background services (macOS)  

Code Signing and Team Identifiers

  To validate software integrity, ensure these identifiers are recognized:

• macOS Team ID: BZA6SZ8XVQ

• Windows Publisher: Beyond Identity, Inc.

Network Requirements

  The Authenticator must be able to reach Beyond Identity’s cloud endpoints. Ensure   the following domains and subdomains are allow-listed in firewalls and proxies:

• *.beyondidentity.com

• *.byndid.com

Security Tool Compatibility

  Some endpoint security agents may require exclusions for Beyond Identity processes   to prevent interference with authentication flows. Consult your EDR/AV documentation   for configuring exceptions.

Deployment Considerations by MDM Platform

  The Beyond Identity Platform Authenticator (PA) can be deployed using common   MDM solutions such as Microsoft Intune, Jamf, and Kandji. Because the PA performs   critical security and enrollment functions, the timing and method of deployment   directly affect user onboarding and update behavior.

  This section outlines the supported deployment methods and important considerations   for each MDM platform.

General Requirements

Regardless of MDM platform:

Microsoft Intune

Recommended: Line of Business (LOB) Deployment

  The preferred method for Windows deployment is   Intune Line of Business (LOB)   installation using the native   .msi package.

Benefits

• Installs after user account creation

• Preserves automatic update functionality

•       Provides the most consistent experience for first-time passkey enrollment    

Considerations

•       Installation timing can vary based on device enrollment, policy load,       and network conditions.
        Admins should be aware that the PA may not be available immediately when       the user logs in for the first time.    

Not Recommended: Win32 (Intune WIN) Deployment

  Intune Win32 packaging is   not supported for pre-provisioning   and is not recommended for   managed Windows deployments.

Limitations

•       Win32 deployments occur before the local user account is created    

• This breaks the PA’s automatic update mechanism

• Requires manual updates by IT for every release

•       The PA package (~400 MB) often exceeds customer SLAs for pre-provisioned       app size    

•       Pre-provisioning may lead to       passkey enrollment failures,       as the app may not be ready when needed    

Outcome
  Customers using Win32 for pre-provisioned deployments should expect degraded   functionality and inconsistent onboarding flows.

Jamf (macOS)

  Jamf deployment using the Beyond Identity macOS package is   supported, provided installation   occurs   after the user account is created   on the device.

Benefits

• Supports normal update behavior

• Fully compatible with macOS MDM workflows

Considerations

•       As with Intune, installation timing can vary depending on policy and       network load    

•       If the PA installs too late in the onboarding process, the user may attempt       passkey creation before the application is available    

Kandji (macOS)

  Kandji deployment is also   supported when using the standard   macOS package and allowing installation to occur   post-login.

Benefits

• Normal update behavior is preserved

• Integration fits within typical Kandji Blueprint workflows

Considerations

•       Device variability during enrollment may cause the PA to install later       than expected    

•       Admins should ensure initial passkey enrollment happens only after the       PA is confirmed installed    

iOS and Android

  On iOS and Android, the Platform Authenticator is delivered through the App Store   / Play Store.
  MDM systems may enforce installation, but:

• Installation timing does not impact passkey creation

• Updates are managed through the associated app store

•       No special deployment pathways or constraints apply beyond standard mobile       MDM policy    

Summary of Recommendations

Related Resources

• Full Deployment Prerequisites Article

Changelog (for this article)

• Aug 29, 2025: Consolidated system requirements, supported     OS versions, Authenticator version support, and deployment prerequisites     into one unified article.  

• Oct 7, 2025: Updated Authenticator version numbers for all     supported platforms.  

• Oct 22, 2025: Updated macOS and iPad/iOS versions supported.     Also, updated the macOS Team ID.   

• Nov 19, 2025: Added information on deployments via Intune, Jamf, and Kandji.