Regarding the upcoming change "Device Activation for certain Single Sign-On (SSO) user logins" - we have SAML SSO with Azure Entra Id. Azure by default sets AuthnContext to "unspecified" unless SP explicitly requests a specific AuthnContext. How can we set Salesforce to request for example "mfa"?
You can’t control this from Salesforce. Salesforce doesn’t let you set or customize the AuthnContextClassRef in the SAML request, so it will keep sending a generic/unspecified context.
The way this is meant to work is enforcing MFA on the Entra ID side. Use Conditional Access to require MFA for the Salesforce app, regardless of what AuthnContext Salesforce requests. Salesforce will accept the assertion even if AuthnContext is unspecified. So if you’re trying to influence Device Activation by requesting mfa from Salesforce, that isn’t supported today - IdP-side enforcement is the correct approach.
