From the Okta Admin Console, go to Applications > Applications.

To disable the feature, complete the following steps: Azure AD Conditional Access accepts the Okta MFA claim and allows the user to sign in without requiring them to complete the AD MFA.

So although the user isn't prompted for the MFA, Okta sends a successful MFA claim to Azure AD Conditional Access. This happens when the Office 365 sign-on policy excludes certain end users (individuals or groups) from the MFA requirement. Okta incorrectly sends a successful MFA claim To get out of the resulting infinite loop, the user must re-open the web browser and complete MFA again. If the user completes MFA in Okta but doesn’t immediately access the Office 365 app, Okta doesn’t pass the MFA claim. The user doesn't immediately access Office 365 after MFA.

But again, Azure AD Conditional Access requires MFA and expects Okta to pass the completed MFA claim. If the user is signing in from a network that’s In Zone, they aren't prompted for the MFA. The sign-on policy doesn’t require MFA when the user signs in from an 'In Zone' network but requires MFA when the user signs in from a network that is 'Not in Zone' However, Azure AD Conditional Access requires MFA and expects Okta to pass the completed MFA claim. Neither the org-level nor the app-level sign-on policy requires MFA. Okta sign-on policy is weaker than the Azure AD policy: End users can enter an infinite sign-in loop in the following scenarios:

Mfa ms setup