Hello,   I know that you can use RADIUS-authentication and install the NPS-addon for Azure MFA to get MFA however I am wondering if this is also possible when using SAML-authentication to AzureAD and then scoping the Cisco AnyConnect Enterprise App in a Conditional Access policy (which requires MFA)? I've tried getting it to work, i.e.: * Created a policy that scopes both my user and the Cisco AnyConnect enterprise application ** The policy has: Grant: Require multi-factor authentication   When I check the "Insights & Reporting"-log and filter for that policy and the Cisco AnyConnect enterprise app I can see that the policy applies to my user (I can see my sign-in attempt) but my user is in the "Not applied"-category.   I tried creating a dedicated conditional access policy for AnyConnect (since the one I mentioned before has an additional parameter - session control) and with the dedicated policy my user was in the "Success" category. Now I might be tired but I was expecting my user to be in the "User action required"-category (see below) since if the policy was enabled (it's currently in "report only"-mode) I would have needed to authenticate using my AzureMFA.   Conditional Access; Success: Number of users where the selected polic(ies) granted access and the required controls were satisifed Failure: Number of users where the selected polic(ies) denied access and the required controls were not satisfied User action required: Number of users where the selected report-only policy applied but user action (e.g. MFA or Terms of Use) would be required if the policy were enabled. Not applied: Number of users that are bypassing the selected polic(ies) because the sign-in did not match at least one of the assignments or conditions.   Now have I completely misunderstood "Require multi-factor authentication"; Does it actually prompt for MFA or does it simply require that the user has a MFA setup / is enrolled into MFA? If its the former then I don't understand how my login can be "Sucess" since it should have been "User action required" IF it isn't like this: Having Azure MFA on various services I might have already within some magic hidden timeframe  satisfied that requirement i.e. I have authenticated with another service which requires Azure MFA. If it is the latter then I get that my login is a "Success" since my account is enrolled into MFA.   Microsofts documentation about the "grant" - "Require multi-factor authentication"; Grant controls in Conditional Access policy - Azure Active Directory | Microsoft Docs Sorry for the long post! Best Regards - Karl, Sweden ... View more