2 Factor Authentication is not being triggered with Single Sign On (OpenID Connect)

Question

Testing SSO against Azure AD using openId connect per this developer.force.com documentation

Two-factor authentication is already configured and functions properly for username + password login.

However, in my testing, 2FA will never be required if the user only logs in via SSO. 2FA is only triggered once the user logs in via username and password. From that point on it will be required for SSO login as well.

The identity docs indicate 2FA should work

All Salesforce user interface authentication methods, including username and password, delegated authentication, SAML single sign-on, and social sign-on through an authentication provider, are supported.

Is this known behavior? I find it strange.

To test, disconnect any linked authentication apps from an existing user and revoke their third-party account link.

They should then be able to login using SSO without triggering 2FA.

Answer 1

A few lines further down the page, the doc indicates that profile-based policy must be used in this case:

Use the profile policy when you want to require two-factor authentication for users of the following authentication methods:

• SAML for single sign-on
• Social sign-on in to Salesforce orgs or
• Communities Username and password authentication into Communities

I find it odd that permission set based policy works after user has authenticated once via username and password, but that is what it is.