FIDO is an Unsupported AMR Claim When Using a Third-Party IdP in Okta
Last Updated:
Overview
Okta does not support the FIDO Authentication Methods Reference (AMR) claim when using a third-party Identity Provider (IdP) such as EntraID. Okta normalizes inbound AMR values into internal assurance buckets, causing the FIDO claim to collapse into a generic multifactor authentication (MFA) value rather than a phishing-resistant method. Configure the third-party IdP to send only supported AMR claims to ensure successful claims sharing.
Applies To
- Okta Identity Engine (OIE)
- Third-Party Identity Provider (IdP)
- Authentication Methods Reference (AMR) Claims
Cause
When a user authenticates with FIDO through a third-party IdP like EntraID, the IdP passes the FIDO method in the AMR array. Okta normalizes these inbound AMR values into internal assurance buckets. During this normalization process, Okta collapses the FIDO claim into a generic multifactor authentication (mfa) value.
Consequently, Okta policy evaluation does not surface or treat the FIDO claim as a phishing-resistant authentication method. The Okta System Log reflects this behavior by displaying the collapsed mfa value in the IdpAmrList attribute.
Solution
How do administrators configure the third-party IdP to pass a recognized AMR value?
Administrators must configure the third-party IdP to send an AMR claim that Okta explicitly supports. If the IdP sends an unsupported value, Okta cannot process the specific authentication method correctly.
Access the Okta Developer documentation to review the complete list of supported Authentication Methods Reference claims and configure the third-party Identity Provider to pass a recognized value.
