This message was deleted.

initiated sign-on works fine (I have it in my test environment with Azure AD) and if i click on "MyCitrixApps" the name of my enterprise app in AAD, i get logged on directly and can launch applications

Sweet. I'm in the process of building a SAML configuration now. Glad to hear it's likely to work successfully. Much appreciated!

I haven't tested it with multiple idps, but i doubt that would make any difference. But keep us updated if there is an issue.

It does what I expected it would do, which is to say that it doesn't work with multiple IDPs in the default configuration. By default, the IDP initiated connection sends to the same URL, which then prompts for username instead of just passing through. Our internal IDP software is very configurable and allows me to send IDP initiated connections to a different URL than would normally be expected. I was then able to configure nFactor to listen on that specific HOSTNAME (say normal is host.company.com IDP initiated sends to idphost.company.com, which both resolve to the same IP address of course). Then I was able to configure nFactor to serve up SAML auth as the first factor to idphost.company.com and username only to host.company.com (with SAML as second factor based on rules -- my rules being group membership, but the post mentioned uses a rule based on UPN/email address domain.) I don't know if other IDPs can be configured in a similar manner to ours and I will take those on a case by case basis as needed, but for now my situation this should work well, once I get FAS up and running. Again, I appreciate the responses. If there are other methods to work around the issue, I'd be interested in hearing them too.