SSO fails when using MFA

[makkawi]

Symptoms

When using multifactor authentication, the SSO login fails with the below error:

Message: AADSTS75011: Authentication method 'X509, MultiFactor' by which the user authenticated with the service doesn't match requested authentication method 'Password'. Contact the Incorta - Development application owner.

Diagnosis

Check the XML file generated from the SSO provider, if it has the following line

onelogin.saml2.security.requested_authncontext = urn:oasis:names:tc:SAML:2.0:ac:classes:Password

Solution

This line forces the authentication, using passwords only. Hence, the MFA doesn't work.

Please remove the line mentioned from the SSO properties that are copied to the CMC.

As per Microsoft documentation, this line is optional, so it is safe to be removed.

https://docs.microsoft.com/en-us/troubleshoot/azure/active-directory/error-code-aadsts75011-auth-met...