What must be configured on the Cisco ISE authentication policy for unknown MAC addresses/identities for successful authentication?

'Pass' would immediately authenticate the unknown identity without further checks, which is not the desired behavior for an unknown MAC address.

'Reject' would deny access to the unknown identity outright, preventing any further processing or attempts to identify or onboard the device.

'Drop' would silently discard the authentication request, making troubleshooting difficult and denying access without explicit rejection feedback to the supplicant or network device.

When an authentication policy is configured to 'continue', Cisco ISE proceeds to the next authentication rule or policy set if the current identity or MAC address is not found in the configured identity store, allowing for processing of unknown MAC addresses for purposes like MAB or guest access flows.