This article explains the following error that occurs when Multi-Factor Authentication (MFA) is enabled for an application that uses a Security Assertion Markup Language (SAML) assertion grant type:

{
  "error": "invalid_grant",
  "error_description": "SAML Assertion credentials cannot be used with MFA enabled."
}

• Multi-factor Authentication (MFA)
• API Access Management
• SAML 2.0 Assertion grant

According to the SAML 2.0 Assertion flow documentation, the SAML Assertion is sent to the /token endpoint. This endpoint does not support or handle MFA prompts.

For a SAML assertion grant type, any MFA requirements must be fulfilled during the initial SAML request flow.

Related References

• SAML 2.0 Assertion flow