Enterprise App Salesforce OIDC v2.0

Question

Salesforce has strengthened the security of its platform, and now requires a value to verify that two-factor authentication has been performed.

The value for OIDC (which is what we have configured) is “Authentication Method Reference (AMR)”. But that value is not coming through.

Has anyone else had the same problem?

Answer 1

Salesforce currently requires an MFA indicator to trust devices for SSO. For Entra ID integrations, this is handled differently depending on whether SAML or OpenID Connect is used.

From the available information:

• For SAML-based SSO, Salesforce will rely on the authnmethodreferences claim in the SAML token issued by Entra ID. When this claim contains multipleauthn, Salesforce treats the device as trusted, provided that a Conditional Access policy has enforced MFA. This is explicitly supported and documented.
• For OpenID Connect with Salesforce, Entra ID must be used via the v1 endpoint so that Salesforce can receive the AMR claim in the token. The v1 endpoint can provide the AMR claim; v2 endpoint support for this scenario is not yet available. If the app is configured against the v2 endpoint, the AMR claim will not be present, which matches the behavior described.

So if the Salesforce enterprise app is configured for OIDC against the Entra ID v2.0 endpoint and AMR is missing:

1. Reconfigure the Salesforce OIDC integration to use the Entra ID v1 endpoint, not v2.0.
2. Ensure that Conditional Access is enforcing MFA for the Salesforce app so that the AMR (or authnmethodreferences in SAML scenarios) reflects multi-factor authentication.

Until v2 endpoint support is available for this AMR behavior, using the v1 endpoint is required for Salesforce OIDC to receive the MFA indicator.

---

References:

• Configure Salesforce for Single sign-on in Microsoft Entra ID