I need to override AuthnContextClassRef to be Password when using passkeys

Question

I need to override AuthnContextClassRef to be Password when using passkeys

Mark Haan 0

I have an enterprise App that I'm creating that is used for SSO to a third party that our security policy requires us to use Phishing resistant MFA.

The third party is using OpenText Access Manager, and they had OpenText support on the phone, and the answer was that I have to return the SAML response

[AuthnContextClassRef]urn:oasis:names:tc:SAML:2.0:ac:classes:Password[/AuthnContextClassRef]

Instead of
[AuthnContextClassRef]urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified[/AuthnContextClassRef]

I tried opening cases with M365, 2605140040004684, and 2605210040008087, but they said it is out of scope.

I can return

[AuthnContextClassRef]urn:oasis:names:tc:SAML:2.0:ac:classes:Password[/AuthnContextClassRef]

if I make a new auth strength that supports password only, and make a sign in every time CA rule that requires that auth strength, enable Password auth on the PC login, and use only passwords. This is in conflict with the security policy requiring phishing resistant MFA, WHFB, tokens, etc.

How can I control the value that my Enterprise app returns for AuthnContextClassRef? There is a similar request https://learn.microsoft.com/en-us/answers/questions/5727558/how-to-specify-an-authncontextclassref-in-a-saml-r

and the answer is that it cannot be overridden, but the third party is telling me other customers with Entra are doing this.

I was unable to get the OpenText support technician to try the fix requested by Dan McLaughlin in the previously linked case.

Carolyne 1,151 Reputation points Microsoft Employee

2026-06-08T09:46:35.7066667+00:00

Hello Mark!
From the above and cross referencing the docs, it seems, the fix should be on the OpenText side — they need to include RequestedAuthnContext with http://schemas.microsoft.com/claims/multipleauthn (listed first) in their SAML AuthnRequest to Entra. Entra will then echo it back instead of Unspecified.

Entra does not support returning arbitrary values like urn:oasis:names:tc:SAML:2.0:ac:classes:Password — it only responds to its own recognized context class (multipleauthn).

Your answer

Carolyne 1,151 Reputation points Microsoft Employee

2026-06-08T09:46:35.7066667+00:00

Hello Mark!
From the above and cross referencing the docs, it seems, the fix should be on the OpenText side — they need to include RequestedAuthnContext with http://schemas.microsoft.com/claims/multipleauthn (listed first) in their SAML AuthnRequest to Entra. Entra will then echo it back instead of Unspecified.

Entra does not support returning arbitrary values like urn:oasis:names:tc:SAML:2.0:ac:classes:Password — it only responds to its own recognized context class (multipleauthn).