A community member has associated this post with a similar question:
How to specify an AuthnContextClassRef in a SAML Response

Only moderators can edit this content.

Update to Salesforce SAML SSO - SAML Attribute needs to be

Neptune Support 0 Reputation points
2026-01-20T19:59:44.0666667+00:00

We've received notice that Salesforce SSO is updating for Device authentication, requiring the IDP to provide the following information

AuthnContextClassRef Values The SAML assertion should contain an `

Microsoft Security | Microsoft Entra | Microsoft Entra ID
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Michele Ariis 7,315 Reputation points MVP Volunteer Moderator
    2026-01-21T08:06:58.0433333+00:00

    Hi, the issue is that Azure AD / Entra ID does not automatically translate MFA or Authentication Strength into standard SAML values, so even when Conditional Access is configured, the SAML assertion remains unchanged.

    The only practical options are to use custom claims (for example, setting SessionLevel = HIGH_ASSURANCE when MFA is satisfied) or to engage Azure support to verify whether and how AuthnContextClassRef can be properly emitted.

    0 comments