How to Configure the Use Okta MFA for Azure AD Option

Federating Microsoft Office 365 with Okta can cause duplicate multifactor authentication (MFA) prompts. The Use Okta MFA for Azure AD option passes the Okta MFA claim to Microsoft Office 365, satisfying the security requirements with a single prompt. Enable the Use Okta MFA for Azure AD option in the application sign-on settings to pass the multifactor authentication claim to Microsoft Office 365.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Microsoft Office 365 WS-Fed
• Entra ID (Azure AD)

What steps configure the Okta MFA for Azure AD option?

Navigate to the Microsoft Office 365 application in the Okta Admin Console, enable the Okta MFA from Azure AD option in the sign-on settings, and verify the federated identity provider behavior using PowerShell.

1. In the Okta Admin Console, go to Applications, and then select Applications.
2. Select the WS-Federated Microsoft Office 365 application.
3. Choose the Sign On tab, and then select Edit.
4. For the Okta MFA from Azure AD option, select Enable for this application, and then choose Save.
5. Run the following PowerShell command to verify the FederatedIdpMfaBehavior returns enforceMfaByFederatedIdp:

   Connect-MgGraph -Scopes Directory.AccessAsUser.All Get-MgDomainFederationConfiguration -DomainId | Select-Object FederatedIdpMfaBehavior