Can I enable MFA on an instance that has SAML SSO enabled?

[suzukieri]

I have SSO SAML enabled on a running instance.
I would like to additionally enable Multi-factor Authentication.
However, for various reasons, we are unable to prepare a verification environment.

I want users to be prompted for a one-time password after SAML authentication.
Is that possible?

Thank you.

[Artem Tyndyk]

The MFA is not compatible with a SSO authentication - any user can login per one of those methods only. However, you can define a specific group of users (e.g. admins) who will access the instance using MFA rather than SSO.

To achieve this, you need to define a role-based multi-factor criteria which will enforce MFA for particular users or groups. This would override SSO.

[Maik Skoddow · Accepted solution]

Hi @Suzuki Eri 

yes, since San Diego this is possible. Please see the respective documentation page https://docs.servicenow.com/en-US/bundle/sandiego-platform-administration/page/integrate/authenticat...

Kind regards
Maik

[Artem Tyndyk]

Cool, didn't know about that San Diego enhancement! Then it's time for @Suzuki Eri to upgrade 😉

[suzukieri]

Thank you both for sharing.
We are checking to see if the Docs you gave us are what we want to do.