Offline days are not downloaded after a successful online authentication for Entra-ID joined machines
2 months ago
Article Number
000073945
Applies To

RSA Product Set: SecurID Access

RSA Product/Service Type: MFA Agent for Windows

RSA Version/Condition: 2.x

Issue
  • After configuring the MFA Agent 2.4.3 on an EntraID joined (not hybrid) windows 11 machine using powershell script (intune configuration).
  • MFA agent is configured to directly connect with RSA Cloud Authentication Services
  • Online authentication works successfully, however offline days are not downloaded.
Cause

 

  • From the MFA logs (AzureAuthentication(RSA.WinAgentWindowsService) file) , we can see that the agent is not able to retrieve the required user attributes from Azure AD and the lookup by UPN is failing:

 

[Local: 2026-03-16 17:04:51.804] 2026-03-16 16:04:51.804 5156.25 [V] [RSA.Authentication.Azure.Services.AzureAuthSvc.ObfuscatedMethodName] Returning 0 attributes

[Local: 2026-03-16 16:50:15.693] 2026-03-16 15:50:15.693 23700.1 [V] [UserIdentityCache.LookupNtAccountNameByUpn] Enter

[Local: 2026-03-16 16:50:15.693] 2026-03-16 15:50:15.693 23700.1 [V] [UserIdentityCache.LookupNtAccountNameByUpn] Looking up: email@rsalab.com

[Local: 2026-03-16 16:50:15.694] 2026-03-16 15:50:15.694 23700.1 [W] [UserIdentityCache.LookupNtAccountNameByUpn] Lookup failed

[Local: 2026-03-16 16:50:15.694] 2026-03-16 15:50:15.694 23700.1 [V] [UserIdentityCache.LookupNtAccountNameByUpn] Return

 

  • When checking the permissions on the application in the Azure tenant, it was found that it is configured with Delegated permissions instead of Application permissions.

 

 

  • Knew that Microsoft Graph supports two access scenarios, delegated access and app-only access. In delegated access, the app calls Microsoft Graph on behalf of a signed-in user. In app-only access, the app calls Microsoft Graph with its own identity, without a signed-in user.


To support these access scenarios, Microsoft Graph exposes delegated permissions and application permissions.
Ref: https://learn.microsoft.com/en-us/graph/permissions-overview?tabs=http

Resolution
  • Change the permission type to Application.
  • Optional: Instead of User.Read.All and Group.Read.All, assign the following minimum required permissions with type set to Application:
    • User.ReadBasic.All
    • GroupMember.Read.All

 

NOTE:

For entra-joined windows machines: RSA MFA agent should be directly connected to RSA Cloud Authentication Services (CAS) instead of RSA Authentication Manager, to ensure that offline days are downloaded successfully

Notes

For entra-joined windows machines: RSA MFA agent should be directly connected to RSA Cloud Authentication Services (CAS) instead of RSA Authentication Manager, to ensure that offline days are downloaded successfully

Related Articles

Trending Articles

Don't see what you're looking for?