Entra OIDC proxying and ACR values

[Wessel, Keith]

Hi, all,

Wondering if anyone on this list has tried proxying to Microsoft Entra using OIDC and passing requested authentication contexts.

Microsoft lets you define custom ACRs that it names c1 through c99. So, I'm having my IdP translate the Refeds MFA ACR to c1, and we're trying to use a conditional access policy on the Entra side to require MFA. The IdP is passing an acr_values header with a value of c1 to Entra; Microsoft doesn't advertise supporting requested claims in their OP metadata, so it's using acr_values. But Entra seems to be ignoring the acr_values request. And Microsoft's documentation is a bit sparse on what needs to be passed in to make it work, and Microsoft seems to be ignoring he acr_values.

Has anyone tried and had success with this?

Thanks,
Keith