> How does 2fa works? If a user is already logged in using SSO but accessing a > second SP that requires 2fa, would it trigger 2fa? That depends entirely on what you configure it to do and what "requires 2fa" means operationally in any given case. Services can request different authentication context requirements and IdPs can impose them. -- Scott