Entra settings are not respecting the MFA token for SAML sign-ins

Question

Entra settings are not respecting the MFA token for SAML sign-ins

Jeffrey Mangiafesto 0

users unable to sign in due to a 2fa interrupt.
We leverage Google SSO / SAML configuration, all o365 apps and Azure related logins are being blocked but only periodically.
Although we have about 100 users that can login seamlessly using our SSO configuration, periodically a user will get kicked out and it takes a significant amount of cache clearing locally to resolve the problem. The error indicates failure to complete 2fa even though our settings are configured to bypass MS 2fa and rely on our SAML connection for 2FA.

I've also submitted a formal ticket to Entra / Azure support 3 weeks ago (Aug 4th) with no response at all, we've also tried having the MS365 team try escalating the ticket since we haven't heard back. Using the paid version of support, but still unable to get a response other than automated ticket generation. ticket #26***7347

0 comments

1 answer

Your answer

Answer 1

Hi Jeffrey,

This behavior usually occurs when the cached Entra session expires and Google’s new SAML assertion does not tell Entra that MFA was completed. Clearing the cache only forces another authentication attempt; it does not correct the federation configuration.

For SAML 2.0, Google must send this value inside the assertion’s AuthnContextClassRef:

http://schemas.microsoft.com/claims/multipleauthn

Your Entra federation must also use acceptIfMfaDoneByFederatedIdp or enforceMfaByFederatedIdp. Microsoft documents the required assertion format here.

Review an affected attempt under Entra ID > Sign-in logs > Authentication Details and Conditional Access. Confirm whether it says “MFA requirement satisfied by claim in the token,” and check for security defaults, per-user MFA, sign-in-frequency policies or Microsoft’s mandatory Azure MFA enforcement. Azure MFA requirements cannot always be bypassed, but valid Google MFA claims can satisfy them.

For the delayed paid-support case, reply requesting a severity review and escalation to the Identity/Federation team. Remove the full ticket number from the public post.

Thank you, and feel free to respond back for more assistance.