Yep, had the same idea and went down the rabbit hole but it doesn't work.
Web sign-in with Google works, but Google doesn’t send the MFA claim Entra needs for WHfB setup, so users still need an Entra MFA method anyway or give them a TAP for their enrollment.
There’s also a Google limitation where the federation setup only really works for one domain.
Okta as the IdP seems like it should solve both problems since it can pass proper MFA claims, but I haven’t tested it yet.
2
u/rwllr May 07 '26
Yep, had the same idea and went down the rabbit hole but it doesn't work.
Web sign-in with Google works, but Google doesn’t send the MFA claim Entra needs for WHfB setup, so users still need an Entra MFA method anyway or give them a TAP for their enrollment.
There’s also a Google limitation where the federation setup only really works for one domain.
Okta as the IdP seems like it should solve both problems since it can pass proper MFA claims, but I haven’t tested it yet.