> We want to enable Duo for just a few SPs. I believe this needs to be configured > in mfa-authn-config.xml in this bean No. Doing that is handled by attaching supportedPrincipals to an override for the RP(s) or via metadata, and then using that to influence the isAcceptable() calls in the transition rules. -- Scott