What may be true however is that you may not have the ability to control which applications get MFA'd by Okta, given that they very likely do not support the actual proxying semantics of SAML or have the ability to consume the RequesterID element to influence behavior. So if you didn't mean all or nothing re: MFA, then you may be correct. -- Scott