Microsoft Entra ID
AuthenticationSingle Sign On Saml Protocol
In brief
The documentation now identifies device-based X.509 authentication with the `x509` AMR value and explains that `x509` alone does not meet phishing-resistant MFA requirements. An additional authentication factor is required.
What Entra admins need to know
Administrators evaluating SAML `amr` claims should account for the `x509` value and its MFA limitation.
This editorial summary was generated by AI from the documentation changes. Verify important details in the full Microsoft Learn article.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
| Certificate-based authentication (phishing-resistant MFA) | SmartcardPKI when used as MFA; X509 for single-factor CBA | Certificate-based authentication (CBA). |
| Temporary Access Pass (TAP) | Unspecified | A Temporary Access Pass. |
| Windows Integrated Authentication (Kerberos) | Kerberos | Windows Integrated Authentication. |
| Federated IdP (pass-through)Device based X509 authentication | Existing rules applyX509 | The value passes through fromA certificate on the federateddevice proves the device's identity provider. |
authnmethodreferences
| Certificate-based authentication (phishing-resistant MFA) | x509, plus multipleauthn (default for multifactor CBA, or when MFA is completed with another factor for single-factor CBA) | Certificate-based authentication. |
| Temporary Access Pass (TAP) | otp, multipleauthn | A Temporary Access Pass. |
| Windows Integrated Authentication (Kerberos) | wia | Windows Integrated Authentication. |
| Federated IdP (pass-through)Device based X509 authentication | Existing rules applyx509 | The value passes through fromA certificate on the federateddevice proves the device's identity provider. |
Microsoft includes x509 in the amr claim for both single-factor Certificate-Based Authentication (CBA) and device-based X.509 authentication. However, the presence of x509 alone does not qualify as phishing-resistant MFA (PRMFA). To meet PRMFA requirements, the user must also complete an additional MFA factor, which will be reflected by other authentication method indicators in the authentication context.
\ No newline at end of file
Microsoft Entra ID is rolling out more granular AMR values that replace
otpfor both SAML and OIDC v2.0 tokens: Microsoft Authenticator TOTP sendstotp, hardware OATH token sendshotp, SMS sendssms, phone call sendstel, email OTP sendsemailotp, and Temporary Access Pass sendstap.
@@ -331,7 +331,7 @@ The `AuthnContextClassRef` value reflects the method the user used to authentica | Certificate-based authentication (phishing-resistant MFA) | `SmartcardPKI` when used as MFA; `X509` for single-factor CBA | Certificate-based authentication (CBA). | | Temporary Access Pass (TAP) | `Unspecified` | A Temporary Access Pass. | | Windows Integrated Authentication (Kerberos) | `Kerberos` | Windows Integrated Authentication. |-| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |+| Device based X509 authentication | `X509` | A certificate on the device proves the device's identity | #### authnmethodreferences @@ -368,10 +368,12 @@ The following table lists the `authnmethodsreferences` values that Microsoft Ent | Certificate-based authentication (phishing-resistant MFA) | `x509`, plus `multipleauthn` (default for multifactor CBA, or when MFA is completed with another factor for single-factor CBA) | Certificate-based authentication. | | Temporary Access Pass (TAP) | `otp`, `multipleauthn` | A Temporary Access Pass. | | Windows Integrated Authentication (Kerberos) | `wia` | Windows Integrated Authentication. |-| Federated IdP (pass-through) | Existing rules apply | The value passes through from the federated identity provider. |+| Device based X509 authentication | `x509` | A certificate on the device proves the device's identity |++Microsoft includes `x509` in the `amr` claim for both single-factor Certificate-Based Authentication (CBA) and device-based X.509 authentication. However, the presence of x509 alone does not qualify as phishing-resistant MFA (PRMFA). To meet PRMFA requirements, the user must also complete an additional MFA factor, which will be reflected by other authentication method indicators in the authentication context. > [!NOTE] > The `amr` claim is sent by default for Salesforce applications, so no configuration change is required for those apps. For all other SAML applications, the application administrator must add the optional `amr` claim with the `include_granular_amr` additional property to the app registration to request AMR claims. The `multipleauthn` and `mfa` values are emitted only when the user has completed MFA. > [!NOTE]-> Microsoft Entra ID is rolling out more granular AMR values that replace `otp` for both SAML and OIDC v2.0 tokens: Microsoft Authenticator TOTP sends `totp`, hardware OATH token sends `hotp`, SMS sends `sms`, phone call sends `tel`, email OTP sends `emailotp`, and Temporary Access Pass sends `tap`.\ No newline at end of file+> Microsoft Entra ID is rolling out more granular AMR values that replace `otp` for both SAML and OIDC v2.0 tokens: Microsoft Authenticator TOTP sends `totp`, hardware OATH token sends `hotp`, SMS sends `sms`, phone call sends `tel`, email OTP sends `emailotp`, and Temporary Access Pass sends `tap`.