SP require MFA for existing session

[Scott Cantor]

> On Apr 24, 2026, at 8:26 AM, Bobby Lawrence via users <users at shibboleth.net> wrote:
> 
> I want to require MFA for a particular virtual directory, but when a user already has a session on my SP, it seems like the SP software just lets them right in.  I know I can enforce AccessControl policies on that path, but I'd rather send the user back to the IdP and require them to do some kind of MFA.

There is no way to enforce anything per-request without access control.

Sending them back to the IdP is a function of error handling, and is best handled by an application. Trying to do it statically would require custom error handling via redirection.

-- Scott