Google Workspace SSO and Salesforce Phishing-Resistant MFA

 Hi everyone,

Has anyone configured Google Workspace SSO with Salesforce to support Phishing-Resistant MFA without prompting users to register a passkey in Salesforce after SSO login?

Google Workspace sends an unspecified in the SAML AuthnContextClassRef (ACR), so Salesforce does not recognize the authentication method used.

Is there a way to address this through SAML ACR/AMR attributes or Salesforce identity verification settings?

Thanks!