Salesforce Authentication for privileged users via Azure Entra

Alejandro Cortes 35

We are preparing for Salesforce’s upcoming phishing-resistant MFA enforcement for admins:

Salesforce documentation

Environment:

Microsoft Entra ID as IdP
SAML SSO to Salesforce
Users authenticate with Windows Hello for Business
Entra Conditional Access requires phishing-resistant MFA

However, the SAML assertion sends:

urn:oasis:names:tc:SAML:2.0:ac:classes:Unspecified

Salesforce says they detect phishing-resistant auth via AMR/ACR values like fido2, wia, hwk, etc.

Questions:

Can Entra emit stronger AuthnContext/ACR values for Salesforce?
Has anyone successfully made Salesforce recognize Entra WHfB logins as phishing-resistant MFA?

Trying to determine whether this is an Entra limitation, Salesforce limitation, or a configuration issue.

Bertrand Agier 0 Reputation points

2026-06-25T16:28:46.72+00:00

Hi Alejandro, an update has just been published by Microsoft here : https://learn.microsoft.com/en-us/entra/identity/saas-apps/salesforce-tutorial :
Updated: June 24, 2026 - Starting June 29, 2026, Microsoft Entra ID will automatically include Authentication Method References (amr) and Authentication Context References (acr) claims in tokens issued for SAML 2.0 and OpenID Connect (OIDC) applications using the Microsoft identity platform v2.0 endpoint. These claims provide additional information about how the user authenticated and the authentication context satisfied during sign-in. No configuration changes are required in Microsoft Entra ID for Salesforce single sign-on. To help satisfy Salesforce phishing-resistant MFA requirements for Salesforce admins, customers should apply Microsoft Entra Conditional Access policies that require phishing-resistant authentication methods for Salesforce administrator sign-ins

Your answer