Add MFA Claims From Auth0 as an Identity Provider to Satisfy Microsoft Entra ID MFA Controls

When Microsoft Entra ID acts as the Service Provider (SP) and Auth0 acts as the Identity Provider (IdP), Microsoft Entra ID may require Auth0 to handle Multi-Factor Authentication (MFA). Failing to include an MFA claim in the Security Assertion Markup Language (SAML) assertion from Auth0 to Microsoft Entra ID results in an endless redirect loop. Resolve this issue by adding the required MFA claims to the SAML assertion using a Post-Login Action or by modifying the SAML Web App settings.

• Auth0
• Security Assertion Markup Language (SAML) Web App
• Web Services Federation (WS-Fed)

Microsoft Entra ID expects an MFA claim when configured to require the IdP to handle MFA. If Auth0 does not include this MFA claim in the SAML assertion, Microsoft Entra ID continuously redirects the authentication request, creating an endless redirect loop.

How to add MFA claims in Auth0 for federated Identity Providers?

Microsoft provides documentation detailing the expected MFA claim format based on the protocol in the Microsoft Entra ID Expected Inbound Assertions Guide.

Configure MFA Vlaims for WS-Fed or SAML 1.1 Federated Identity Providers

For WS-Fed or SAML 1.1, include the claims in the assertion as part of the AuthenticationStatement element. Review the following XML example to understand the structure of the AuthenticationStatement element.

<saml:AuthenticationStatement
    AuthenticationMethod="http://schemas.microsoft.com/claims/multipleauthn" ..>
    <saml:Subject> ... </saml:Subject>
</saml:AuthenticationStatement>

Alternatively, include the claims in the assertion as part of the AttributeStatement elements. Review the following XML example to understand the structure of the AttributeStatement element.

<saml:AttributeStatement>
  <saml:Attribute AttributeName="authenticationmethod" AttributeNamespace="http://schemas.microsoft.com/ws/2008/06/identity/claims">
       <saml:AttributeValue>...</saml:AttributeValue> 
      <saml:AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</saml:AttributeValue>
  </saml:Attribute>
</saml:AttributeStatement>

Add the claim as a SAML attribute by creating a Post-Login Action with the provided code snippet, as detailed in the Auth0 Post-Login API Reference.

exports.onExecutePostLogin = async (event, api) => {
 api.samlResponse.setAttribute("http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", "http://schemas.microsoft.com/claims/multipleauthn")
};

Configure MFA Claims for SAML 2.0 Federated Identity Providers

For SAML 2.0, Auth0 must include the inbound MFA assertions in the AuthnContext element of the AuthnStatement. Review the following XML example to understand the structure of the AuthnStatement element.

<AuthnStatement AuthnInstant="2024-11-22T18:48:07.547Z">
    <AuthnContext>
        <AuthnContextClassRef>http://schemas.microsoft.com/claims/multipleauthn</AuthnContextClassRef>
    </AuthnContext>
</AuthnStatement>

Change the default AuthnContextClassRef value in the SAML Web App settings by applying the provided JSON configuration, as detailed in the Auth0 Customize SAML Assertions Guide.

{
  "authnContextClassRef": "http://schemas.microsoft.com/claims/multipleauthn"
}

Alternatively, add the AuthnContextClassRef value to the SAML assertion by creating a Post-Login Action with the provided code snippet, as detailed in the Auth0 Post-Login API Reference.

exports.onExecutePostLogin = async (event, api) => {
 api.samlResponse.setAuthnContextClassRef( "http://schemas.microsoft.com/claims/multipleauthn")
};