Testing SSO against Azure AD using openId connect per this developer.force.com documentation
Two-factor authentication is already configured and functions properly for username + password login.
However, in my testing, 2FA will never be required if the user only logs in via SSO. 2FA is only triggered once the user logs in via username and password. From that point on it will be required for SSO login as well.
The identity docs indicate 2FA should work
All Salesforce user interface authentication methods, including username and password, delegated authentication, SAML single sign-on, and social sign-on through an authentication provider, are supported.
Is this known behavior? I find it strange.
To test, disconnect any linked authentication apps from an existing user and revoke their third-party account link.
They should then be able to login using SSO without triggering 2FA.