MFA with SSO

By default

Someone who has Waxell MFA (an authenticator app) enrolled is asked for their Waxell code after SSO, even if your IdP already asked them for MFA.

If the workspace requires MFA (Settings → Identity → Require Two-Factor Authentication) and someone hasn't enrolled yet, SSO signs them in and Waxell prompts them to enroll, the same as a password sign-in.

Accept the IdP's MFA

Tick Accept the IdP's MFA on the provider to skip the Waxell prompt when the IdP reports that the person completed MFA. Waxell checks a signed value only:

Protocol	What counts as MFA
OIDC	the verified ID token's amr contains a second factor, such as mfa, otp, hwk, swk, sms, fpt or face
SAML	the signed assertion's AuthnContextClassRef is a multi-factor class, such as http://schemas.microsoft.com/claims/multipleauthn

If the IdP doesn't report MFA, the Waxell prompt still appears. The option is off by default and set per provider.