This message was deleted.

You can setup force authentication on the SAML action. But the it will always require them to type in the mail to start with

Thanks, Mads. Wonder if I can set up a separate action for this group of external folks... about 60. Wouldnt want to do that for the majority of employees as caching the UPN is quite useful, cheers

Encountered something similar when using OAuth/OIDC. Adding a flag to the authorization endpoint seemed to do the trick: -authorizationEndpoint "https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?prompt=select_account" https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc