Passing Custom ACR Values in SAML Attributes

Shishir 0

I'm attempting to pass the correct AuthenticationContextClassRef (ACR) values in SAML attributes to an application for access.

I've already:

Created a new policy and enabled MFA at the application level
Set authentication strength in Conditional Access for the application

However, I am unable to pass custom ACR values (like timesynctoken or x509) in the SAML response. Even when enforcing the conditional access policy, when I decode the SAML assertion, I still see "password" as the ACR value. I need this value to be changed to "timesync token."

Could someone provide the complete steps for this process to pass a custom value of ACR in SAML attributes?

This question is related to the following Learning Module

Harshitha Eligeti 1,695 Reputation points Microsoft Vendor

2025-02-18T11:40:35.4266667+00:00

Hi @Shishir
Thank you for reaching out Microsoft Q&A Platform.
I understand that you are attempting to pass custom Authentication Context Class Reference (ACR) values in the SAML response. However, you are unable to pass c to pass custom ACR values such as "timesynctoken" or "x509" in the response. Despite this, the ACR value is still showing as "password." You are trying to modify the value to "timesynctoken."

Microsoft Entra ID supports following AuthnContextClassRef values.

Please ensure that you attempt to pass the X509 value instead of the timesynctoken.

NOTE: If the RequestedAuthnContext is included in the SAML request, the Comparison element must be set to exact.

For Additional Information, please follow these documents: https://learn.microsoft.com/en-us/entra/identity-platform/single-sign-on-saml-protocol
https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-fed-saml-idp
Hope this helps. Do let us know if you any further queries.

Share via

Passing Custom ACR Values in SAML Attributes

Your answer