Entra.News Dailydaily.entra.news
Aboutmerill.net
Microsoft Entra ID

Single Sign On Saml Protocol

26 June 2026Updated+50 / −1 lines

In brief

</AuthnContext>

Documentation change

```

The AuthnContextClassRef value reflects the method the user used to authenticate. If the user authenticates with more than one method, the strongest method is reflected in the AuthnContextClassRef. The following table lists the AuthnContextClassRef class names that Microsoft Entra ID sends for each authentication method. The full value is urn:oasis:names:tc:SAML:2.0:ac:classes:<className>.

Microsoft Entra authentication method AuthnContextClassRef class name Description
Password Password The user authenticated with a username and password.
Microsoft Authenticator push MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed Push notification approval in Microsoft Authenticator. The two-factor class is sent when the method contributes to MFA.
Microsoft Authenticator TOTP TimeSyncToken Time-based one-time passcode (TOTP) generated by Microsoft Authenticator.
Hardware OATH token TimeSyncToken Time-based one-time passcode generated by a hardware OATH token.
Phone sign-in (passwordless Authenticator) MobileTwoFactorContract Passwordless phone sign-in approved in Microsoft Authenticator.
SMS MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed One-time passcode delivered by text message.
Phone call Telephony, or MobileTwoFactorContract when another factor is also completed Approval through a voice phone call.
Email MobileOneFactorUnregistered, or MobileTwoFactorContract when another factor is also completed One-time passcode delivered by email.
FIDO2 security key (phishing-resistant MFA) SmartcardPKI A FIDO2 security key, reported as a smartcard-backed certificate with a private key and PIN.
Passkey - device-bound (phishing-resistant MFA) SmartcardPKI A device-bound passkey.
Passkey - synced SoftwarePKI A synced passkey, reported as a software-based PKI credential.
Windows Hello for Business (phishing-resistant MFA) SmartcardPKI Windows Hello for Business.
Certificate-based authentication (phishing-resistant MFA) SmartcardPKI when used as MFA; X509 for single-factor CBA Certificate-based authentication (CBA).
Temporary Access Pass (TAP) Unspecified A Temporary Access Pass.
Windows Integrated Authentication (Kerberos) Kerberos Windows Integrated Authentication.
Federated IdP (pass-through) Existing rules apply The value passes through from the federated identity provider.

authnmethodreferences

This element asserts that the assertion subject was authenticated by a particular means at a particular time. This is available in the claims section for applications to consume and verify that subject has done authentication using Password or using a stronger authentication method like MFA or Passkeys. http://schemas.microsoft.com/claims/multipleauthn

\ No newline at end of file


The following table lists the `authnmethodsreferences` values that Microsoft Entra ID sends for each authentication method. Each value is emitted under the `http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/<value>` namespace, except `multipleauthn`, which is emitted as `http://schemas.microsoft.com/claims/multipleauthn`. The `multipleauthn` value is included only when the user completed multifactor authentication (MFA).
Microsoft Entra authentication method authnmethodsreferences value Description
Password password The user authenticated with a username and password.
Microsoft Authenticator push rsa, plus multipleauthn when MFA is completed with another factor Push notification approval in Microsoft Authenticator.
Microsoft Authenticator TOTP otp, plus multipleauthn when MFA is completed with another factor Time-based one-time passcode (TOTP) from Microsoft Authenticator.
Hardware OATH token otp, plus multipleauthn when MFA is completed with another factor One-time passcode from a hardware OATH token.
Phone sign-in (passwordless Authenticator) swk, multipleauthn Passwordless phone sign-in, reported as a software key.
SMS otp, plus multipleauthn when MFA is completed with another factor One-time passcode delivered by text message.
Phone call otp, plus multipleauthn when MFA is completed with another factor Approval through a voice phone call.
Email otp, plus multipleauthn when MFA is completed with another factor One-time passcode delivered by email.
FIDO2 security key (phishing-resistant MFA) fido, multipleauthn A FIDO2 security key.
Passkey - device-bound (phishing-resistant MFA) fido, multipleauthn A device-bound passkey.
Passkey - synced fido, multipleauthn A synced passkey.
Windows Hello for Business (phishing-resistant MFA) hwk, multipleauthn Windows Hello for Business, reported as a hardware-bound key.
Certificate-based authentication (phishing-resistant MFA) x509, plus multipleauthn (default for multifactor CBA, or when MFA is completed with another factor for single-factor CBA) Certificate-based authentication.
Temporary Access Pass (TAP) otp, multipleauthn A Temporary Access Pass.
Windows Integrated Authentication (Kerberos) wia Windows Integrated Authentication.
Federated IdP (pass-through) Existing rules apply The value passes through from the federated identity provider.

\ No newline at end of file