How are you checking Entra’s MFA signals for Salesforce?

Check the sign-in evidence on the Entra side, then compare the AMR value actually sent with the exact values Salesforce currently says it accepts. A successful login by itself does not prove the required signal was present.

If the logs do not show the outgoing SAML claim clearly, validate the assertion in a controlled test rather than assuming Salesforce’s login records will tell you what it received. The reports on Salesforce logging are mixed, so I would not make that your only check.

I’d test the actual methods users will use, one at a time. Passkeys may be a route to phishing-resistant sign-in, but the key question here is still what Entra puts in the assertion and whether that matches Salesforce’s documented requirement. Don’t infer the signal just from the method’s name.

If you can’t confirm the claim end to end, treat that as an unresolved rollout risk. Ask Salesforce support whether a temporary extension is available, and agree on a fallback with the Salesforce admin before enforcing the change. An extension is something to request, not something to count on.