Hello @RossW.33813 (Customer)​ Thank you for posting on our Community page!

This should be achievable. You can try the below guidance on this issue:

You need to configure Entra ID to send the Authentication Methods References (AMR). This indicates how the user authenticated.

1. In Entra ID: Navigate to your Enterprise Application (the Okta integration). Under Attributes & Claims, add a new claim.
2. Claim Name: amr (or a custom name like mfa_methods).

Source Attribute: Use the transformation or attribute that maps to the authentication method.

Note: Entra's SAML implementation doesn't always expose the granular "phone" vs "software token" via a simple dropdown. You may need to use Conditional Access Authentication Strengths in Entra to ensure the user is forced into a specific bucket before they even get to Okta.

3. Source Attribute: Use the transformation or attribute that maps to the authentication method.

Note: Entra's SAML implementation doesn't always expose the granular "phone" vs "software token" via a simple dropdown. You may need to use Conditional Access Authentication Strengths in Entra to ensure the user is forced into a specific bucket before they even get to Okta.

4. In Okta: Map this incoming claim to a custom attribute in the Okta User Profile (e.g.,

user.ext_amr_methods).

5. Okta Policy: Update your Expression Language check:

user.profile.ext_amr_methods.contains("fido") or !user.profile.ext_amr_methods.contains("sms").

Thank you for reaching out to our Community and have a great day!

--

Help others in the community by liking or hitting Select as Best if this response helped you.

Join the discussion for our Ask Me Anything on January 20, 2026: Adoption of Stronger Authentication MFA. Ask our expert questions. 

How to achieve this : Adding user.profile. authmethods.contains("http://schemas.microsoft.com/claims/multipleauthn") to the CA policy ensures MFA has been used"

What I want to configure:

EntraID IDP, Okta as SP, I tried to map custom attributes from the IDP assertion to Okta attributes using directory profile mapping. Tried to use that in the authentication policy expression, but it doesn't work well. Is there any documentation available to go over it?

I do not intend to save the assertion values in the Okta user profile, so I am not using JIT. We only want to use the EntraID MFA for authentication and if its succesful, redirect user to the application or Okta dashboard.