Internal auth is paired with required MFA. Microsoft SSO inherits Entra MFA according to tenant policy.