Entra ID - External ID - SAML - MFA Strength

Hello @RossW.33813 (Customer)​ Thank you for posting on our Community page!

This should be achievable. You can try the below guidance on this issue:

You need to configure Entra ID to send the Authentication Methods References (AMR). This indicates how the user authenticated.

1. In Entra ID: Navigate to your Enterprise Application (the Okta integration). Under Attributes & Claims, add a new claim.
2. Claim Name: amr (or a custom name like mfa_methods).

Source Attribute: Use the transformation or attribute that maps to the authentication method.

Note: Entra's SAML implementation doesn't always expose the granular "phone" vs "software token" via a simple dropdown. You may need to use Conditional Access Authentication Strengths in Entra to ensure the user is forced into a specific bucket before they even get to Okta.

3. Source Attribute: Use the transformation or attribute that maps to the authentication method.

Note: Entra's SAML implementation doesn't always expose the granular "phone" vs "software token" via a simple dropdown. You may need to use Conditional Access Authentication Strengths in Entra to ensure the user is forced into a specific bucket before they even get to Okta.

4. In Okta: Map this incoming claim to a custom attribute in the Okta User Profile (e.g.,

user.ext_amr_methods).

5. Okta Policy: Update your Expression Language check:

user.profile.ext_amr_methods.contains("fido") or !user.profile.ext_amr_methods.contains("sms").

Thank you for reaching out to our Community and have a great day!

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Join the discussion for our Ask Me Anything on January 20, 2026: Adoption of Stronger Authentication MFA. Ask our expert questions. 

How to achieve this : Adding user.profile. authmethods.contains("http://schemas.microsoft.com/claims/multipleauthn") to the CA policy ensures MFA has been used"

What I want to configure:

EntraID IDP, Okta as SP, I tried to map custom attributes from the IDP assertion to Okta attributes using directory profile mapping. Tried to use that in the authentication policy expression, but it doesn't work well. Is there any documentation available to go over it?

I do not intend to save the assertion values in the Okta user profile, so I am not using JIT. We only want to use the EntraID MFA for authentication and if its succesful, redirect user to the application or Okta dashboard.

Updating this response for ease of access and reference:

Administrators configuring Microsoft Entra ID as an external Identity Provider (IdP) via SAML can verify multifactor authentication (MFA) by checking the SAML assertion for the multipleauthn claim. However, organizations requiring strict security must enforce specific MFA strengths and block weak methods like SMS or email. Because the Microsoft Entra ID SAML implementation fails to expose granular authentication methods in a standard dropdown claim, administrators must configure alternative methods to enforce MFA strength. Administrators can enforce authentication strengths via Microsoft Entra ID Conditional Access, map custom Authentication Methods References (AMR) claims in SAML, or migrate to an OpenID Connect (OIDC) integration.

Applies To

• Okta Identity Engine (OIE)
• External Identity Provider (IdP)
• Microsoft Entra ID
• SAML 2.0
• OpenID Connect (OIDC)

Solution

How do administrators enforce authentication strengths via Microsoft Entra ID Conditional Access?

Enforce the multifactor authentication (MFA) requirement in Microsoft Entra ID before the SAML assertion generates and sends to Okta by configuring a Conditional Access policy.

1. In the Microsoft Entra admin center, navigate to Protection, select Authentication methods, and choose Authentication strengths.
2. Create a custom Authentication Strength that includes only the approved methods and explicitly excludes SMS and Voice.
3. Navigate to Protection, select Conditional Access, and create a policy targeting the Okta Enterprise Application.
4. Under Grant, require the specific Authentication Strength created in the previous step.

Administrators can map custom Authentication Methods References claims in SAML to evaluate the policy in Okta.

Pass the Authentication Methods References (AMR) as a custom SAML claim to allow Okta to evaluate the authentication policy.

1. In Microsoft Entra ID, navigate to the Okta Enterprise Application and open Attributes & Claims.
2. Add a new claim.
3. Configure the Source Attribute using a transformation or directory extension attribute that maps to the registered authentication method of the user.
4. NOTE: This requires advanced Microsoft Entra ID claim transformations, as the system fails to expose granular methods in a simple dropdown menu.
5. In the Okta Admin Console, map this incoming claim to a custom attribute in the Okta user profile.
6. Update the Okta Authentication Policy using an Okta Expression Language check to verify the authentication method.

user.profile.ext_amr_methods.contains("fido") or !user.profile.ext_amr_methods.contains("sms")

Migrating to an OpenID Connect integration allows Okta to natively evaluate granular authentication policies.

Migrate the external Identity Provider (IdP) integration from SAML 2.0 to OpenID Connect (OIDC) to natively support the Authentication Methods References (AMR) claim in the ID token. When integrated via OIDC, Microsoft Entra ID natively passes an array of strings to Okta. This allows Okta Authentication Policies to parse and evaluate the exact MFA method used without complex custom claim transformations.

Summary

Enforce specific multifactor authentication strengths by configuring Microsoft Entra ID Conditional Access, mapping custom SAML claims, or migrating to OIDC.

Regards.

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Collect them all. Learn a new skill and earn a new Okta Learning badge.

Just released: More Okta Community badges just added