Microsoft Entra IDSingle Sign On Saml Protocol
In brief
</AuthnContext>
What Entra admins need to know
Review the documentation change to determine whether it affects tenant configuration, security posture, or rollout plans.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
Open on Microsoft Learn ↗The comparison below is an extract of the Microsoft Learn article showing only the changed content. Open the full article for complete context.
```
####
The AuthnContextClassRef value reflects the method the user used to authenticate. If the user authenticates with more than one method, the strongest method is reflected in the AuthnContextClassRef. The following table lists the AuthnContextClassRef class names that Microsoft Entra ID sends for each authentication method. The full value is urn:oasis:names:tc:SAML:2.0:ac:classes:<className>.
| Microsoft Entra authentication method | AuthnContextClassRef class name | Description |
|---|---|---|
| Password | Password | The user authenticated with a username and password. |
| Microsoft Authenticator push | MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed | Push notification approval in Microsoft Authenticator. The two-factor class is sent when the method contributes to MFA. |
| Microsoft Authenticator TOTP | TimeSyncToken | Time-based one-time passcode (TOTP) generated by Microsoft Authenticator. |
| Hardware OATH token | TimeSyncToken | Time-based one-time passcode generated by a hardware OATH token. |
| Phone sign-in (passwordless Authenticator) | MobileTwoFactorContract | Passwordless phone sign-in approved in Microsoft Authenticator. |
| SMS | MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed | One-time passcode delivered by text message. |
| Phone call | Telephony, or MobileTwoFactorContract when another factor is also completed | Approval through a voice phone call. |
MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed | One-time passcode delivered by email. | |
| FIDO2 security key (phishing-resistant MFA) | SmartcardPKI | A FIDO2 security key, reported as a smartcard-backed certificate with a private key and PIN. |
| Passkey - device-bound (phishing-resistant MFA) | SmartcardPKI | A device-bound passkey. |
| Passkey - synced | SoftwarePKI | A synced passkey, reported as a software-based PKI credential. |
| Windows Hello for Business (phishing-resistant MFA) | SmartcardPKI | Windows Hello for Business. |
| Certificate-based authentication (phishing-resistant MFA) | SmartcardPKI when used as MFA; X509 for single-factor CBA | Certificate-based authentication (CBA). |
| Temporary Access Pass (TAP) | Unspecified | A Temporary Access Pass. |
| Windows Integrated Authentication (Kerberos) | Kerberos | Windows Integrated Authentication. |
| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |
authnmethodreferences
This element asserts that the assertion subject was authenticated by a particular means at a particular time. This is available in the claims section for applications to consume and verify that subject has done authentication using Password or using a stronger authentication method like MFA or Passkeys.
\ No newline at end of file
\ No newline at end of file
The following table lists the `authnmethodsreferences` values that Microsoft Entra ID sends for each authentication method. Each value is emitted under the `http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/<value>` namespace, except `multipleauthn`, which is emitted as `http://schemas.microsoft.com/claims/multipleauthn`. The `multipleauthn` value is included only when the user completed multifactor authentication (MFA).
| Microsoft Entra authentication method | `authnmethodsreferences` value | Description |
|---|---|---|
| Password | `password` | The user authenticated with a username and password. |
| Microsoft Authenticator push | `rsa`, plus `multipleauthn` when MFA is completed with another factor | Push notification approval in Microsoft Authenticator. |
| Microsoft Authenticator TOTP | `otp`, plus `multipleauthn` when MFA is completed with another factor | Time-based one-time passcode (TOTP) from Microsoft Authenticator. |
| Hardware OATH token | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode from a hardware OATH token. |
| Phone sign-in (passwordless Authenticator) | `swk`, `multipleauthn` | Passwordless phone sign-in, reported as a software key. |
| SMS | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode delivered by text message. |
| Phone call | `otp`, plus `multipleauthn` when MFA is completed with another factor | Approval through a voice phone call. |
| Email | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode delivered by email. |
| FIDO2 security key (phishing-resistant MFA) | `fido`, `multipleauthn` | A FIDO2 security key. |
| Passkey - device-bound (phishing-resistant MFA) | `fido`, `multipleauthn` | A device-bound passkey. |
| Passkey - synced | `fido`, `multipleauthn` | A synced passkey. |
| Windows Hello for Business (phishing-resistant MFA) | `hwk`, `multipleauthn` | Windows Hello for Business, reported as a hardware-bound key. |
| Certificate-based authentication (phishing-resistant MFA) | `x509`, plus `multipleauthn` (default for multifactor CBA, or when MFA is completed with another factor for single-factor CBA) | Certificate-based authentication. |
| Temporary Access Pass (TAP) | `otp`, `multipleauthn` | A Temporary Access Pass. |
| Windows Integrated Authentication (Kerberos) | `wia` | Windows Integrated Authentication. |
| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |
\ No newline at end of file
@@ -311,6 +311,28 @@ This element asserts that the assertion subject was authenticated by a particula </AuthnContext> </AuthnStatement> ```++The `AuthnContextClassRef` value reflects the method the user used to authenticate. If the user authenticates with more than one method, the strongest method is reflected in the `AuthnContextClassRef`. The following table lists the `AuthnContextClassRef` class names that Microsoft Entra ID sends for each authentication method. The full value is `urn:oasis:names:tc:SAML:2.0:ac:classes:<className>`.++| Microsoft Entra authentication method | `AuthnContextClassRef` class name | Description |+|---|---|---|+| Password | `Password` | The user authenticated with a username and password. |+| Microsoft Authenticator push | `MobileOneFactorUnregistered`, or `MobileTwoFactorContract` when another factor is also completed | Push notification approval in Microsoft Authenticator. The two-factor class is sent when the method contributes to MFA. |+| Microsoft Authenticator TOTP | `TimeSyncToken` | Time-based one-time passcode (TOTP) generated by Microsoft Authenticator. |+| Hardware OATH token | `TimeSyncToken` | Time-based one-time passcode generated by a hardware OATH token. |+| Phone sign-in (passwordless Authenticator) | `MobileTwoFactorContract` | Passwordless phone sign-in approved in Microsoft Authenticator. |+| SMS | `MobileOneFactorUnregistered`, or `MobileTwoFactorContract` when another factor is also completed | One-time passcode delivered by text message. |+| Phone call | `Telephony`, or `MobileTwoFactorContract` when another factor is also completed | Approval through a voice phone call. |+| Email | `MobileOneFactorUnregistered`, or `MobileTwoFactorContract` when another factor is also completed | One-time passcode delivered by email. |+| FIDO2 security key (phishing-resistant MFA) | `SmartcardPKI` | A FIDO2 security key, reported as a smartcard-backed certificate with a private key and PIN. |+| Passkey - device-bound (phishing-resistant MFA) | `SmartcardPKI` | A device-bound passkey. |+| Passkey - synced | `SoftwarePKI` | A synced passkey, reported as a software-based PKI credential. |+| Windows Hello for Business (phishing-resistant MFA) | `SmartcardPKI` | Windows Hello for Business. |+| Certificate-based authentication (phishing-resistant MFA) | `SmartcardPKI` when used as MFA; `X509` for single-factor CBA | Certificate-based authentication (CBA). |+| Temporary Access Pass (TAP) | `Unspecified` | A Temporary Access Pass. |+| Windows Integrated Authentication (Kerberos) | `Kerberos` | Windows Integrated Authentication. |+| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |+ #### authnmethodreferences This element asserts that the assertion subject was authenticated by a particular means at a particular time. This is available in the claims section for applications to consume and verify that subject has done authentication using Password or using a stronger authentication method like MFA or Passkeys. @@ -325,4 +347,31 @@ This element asserts that the assertion subject was authenticated by a particula <AttributeValue>http://schemas.microsoft.com/claims/multipleauthn</AttributeValue> </Attribute> -```\ No newline at end of file+```++The following table lists the `authnmethodsreferences` values that Microsoft Entra ID sends for each authentication method. Each value is emitted under the `http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/<value>` namespace, except `multipleauthn`, which is emitted as `http://schemas.microsoft.com/claims/multipleauthn`. The `multipleauthn` value is included only when the user completed multifactor authentication (MFA).++| Microsoft Entra authentication method | `authnmethodsreferences` value | Description |+|---|---|---|+| Password | `password` | The user authenticated with a username and password. |+| Microsoft Authenticator push | `rsa`, plus `multipleauthn` when MFA is completed with another factor | Push notification approval in Microsoft Authenticator. |+| Microsoft Authenticator TOTP | `otp`, plus `multipleauthn` when MFA is completed with another factor | Time-based one-time passcode (TOTP) from Microsoft Authenticator. |+| Hardware OATH token | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode from a hardware OATH token. |+| Phone sign-in (passwordless Authenticator) | `swk`, `multipleauthn` | Passwordless phone sign-in, reported as a software key. |+| SMS | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode delivered by text message. |+| Phone call | `otp`, plus `multipleauthn` when MFA is completed with another factor | Approval through a voice phone call. |+| Email | `otp`, plus `multipleauthn` when MFA is completed with another factor | One-time passcode delivered by email. |+| FIDO2 security key (phishing-resistant MFA) | `fido`, `multipleauthn` | A FIDO2 security key. |+| Passkey - device-bound (phishing-resistant MFA) | `fido`, `multipleauthn` | A device-bound passkey. |+| Passkey - synced | `fido`, `multipleauthn` | A synced passkey. |+| Windows Hello for Business (phishing-resistant MFA) | `hwk`, `multipleauthn` | Windows Hello for Business, reported as a hardware-bound key. |+| Certificate-based authentication (phishing-resistant MFA) | `x509`, plus `multipleauthn` (default for multifactor CBA, or when MFA is completed with another factor for single-factor CBA) | Certificate-based authentication. |+| Temporary Access Pass (TAP) | `otp`, `multipleauthn` | A Temporary Access Pass. |+| Windows Integrated Authentication (Kerberos) | `wia` | Windows Integrated Authentication. |+| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |++> [!NOTE]+> The `amr` claim is sent by default for Salesforce applications, so no configuration change is required for those apps. For all other SAML applications, the application administrator must add the optional `amr` claim with the `include_granular_amr` additional property to the app registration to request AMR claims. The `multipleauthn` and `mfa` values are emitted only when the user has completed MFA.++> [!NOTE]+> Microsoft Entra ID is rolling out more granular AMR values that replace `otp` for both SAML and OIDC v2.0 tokens: Microsoft Authenticator TOTP sends `totp`, hardware OATH token sends `hotp`, SMS sends `sms`, phone call sends `tel`, email OTP sends `emailotp`, and Temporary Access Pass sends `tap`.\ No newline at end of file