RSA Product Set: SecurID
RSA Product/Service Type: MFA Agent for Windows
RSA Version/Condition: 2.4 and later

For Microsoft Entra ID joined devices, agent settings can be configured using the file generated below. Agent configuration settings for Microsoft Entra ID joined devices are not set through GPO settings.

The RSA_MFA_Agent_Config_Utility_For_Microsoft_Entra_ID.exe creates a template text file  which contains the key-value pairs needed
for the RSA MFA Agent.

To resolve this issue,

1. Make a backup of the original RSA_MFA_Agent_Config.txt.
2. Edit the RSA_MFA_Agent_Config.txt to what is shown below:

########################### Disable RSA authentication for unknown user ###########################
##### Help:
##### If you are using RSA during Windows authentication,
##### this config key specifies if the Agent allows a user unknown to RSA to sign in with only a
##### Windows password.

##### Users are unknown to RSA when they do not exist in an RSA identity source.

##### If you enable this config key, then the Agent allows  unknown users to sign in with only a
##### Windows password and not require additional or passwordless authentication.

##### If you do not configure or disable this config key,
##### then the Agent does not allow unknown users to sign into their computers.

##### Options: 
##### DisableMfaUnknownUser=0 (Allow unknown user) OR
##### DisableMfaUnknownUser=1 (Not allow unknown user)

##### If Enabled=0, whole key will be ignored
Enabled=1

##### Must be reset to 0 if Enabled is set
DisableMfaUnknownUser=1
############################################# ENDKEY ##############################################

3. Save and close the file.