> How can I enable it only for specific service providers? By using a specific custom Principal value to signal it, making the Duo flow support it, and adding a relying party override or metadata driven tag to supply a defaultAuthenticationMethods setting that includes it. And/or SPs request the value at runtime and check for it in the assertion. -- Scott