Okta SAML Single Sign-On Fails For Mobicontrol Application

A Security Assertion Markup Language (SAML) Single Sign-On (SSO) failure occurs for the Mobicontrol application integrated with Microsoft Entra because Okta does not enforce Multi-Factor Authentication (MFA) for Microsoft Office 365. Resolve this issue by enforcing MFA for the Office 365 application in Okta and isolating any conflicting claims. The following error occurs after a user successfully authenticates with Okta and Okta redirects the user to Microsoft Entra:

Sorry, but we're having trouble signing you in.

AADSTS901172: Invalid request. Multiple values are present for a single value claim.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• Mobicontrol
• Microsoft Entra / Microsoft Azure
• Microsoft 365 / Office 365 (M365 / O365)
• Single Sign-On (SSO)

This error occurs because Okta does not enforce multifactor authentication (MFA) for Microsoft Office 365. Additionally, duplicate elements in the authentication methods references or other custom user claims can cause this conflict.

How does Okta enforce the multifactor authentication requirement?

Enforce MFA for the Office 365 application hosted on Okta by configuring the authentication rule.

• Ensure the authentication rule has either Any 2 factor types or Password / IdP + Another factor selected in the User must authenticate with setting.

Isolate the specific claim causing the conflict in the Microsoft Entra ID sign-in logs.

If enforcing MFA in the Okta routing policy does not immediately resolve the error, review the Microsoft Entra ID sign-in logs to locate the failed login attempt and identify the exact claim identifier triggering the error.

1. Sign in to the Microsoft Entra Admin Center.
2. Navigate to Identity > Monitoring & health > Sign-in logs.
3. Locate the failed login attempt using the Correlation ID or Timestamp shown on the error screen.
4. Select the failure row, navigate to the Basic Info and Authentication Details tabs, and review the exact claim identifier triggering the error.

How are duplicate elements verified in the SAML assertion trace?

Capture an HTTP Archive (HAR) or SAML assertion trace to verify that the authentication methods, references, or other custom user claims do not pass duplicate elements.

1. Install a SAML tracing browser extension, such as SAML-tracer, or open the Developer Tools in the browser and select the Network tab. Ensure the selected tool fits the organizational guidelines for troubleshooting tools.
2. Reproduce the login flow from Okta to Mobicontrol and Microsoft Entra.
3. Inspect the <saml2:AttributeStatement> section of the SAML response.
4. Verify that the authentication methods references (amr) or other custom user claims do not pass duplicate elements or structured arrays when a single string is expected.