Northern Trail Outfitters (NTO) has a requirement to ensure all user logins include a single...

When some users sign in through Salesforce credentials and others through an external IdP that already performs MFA, the goal is to avoid prompting everyone twice while still requiring MFA-strength assurance. Salesforce handles that through session security levels. By requiring High Assurance at login and recognizing the corporate identity provider as satisfying High Assurance, the org can accept the IdP’s MFA result while still enforcing stronger authentication for direct Salesforce logins. Enabling the generic “MFA for UI Logins” control alone can force an extra challenge on top of the IdP’s MFA. The architecture lesson is that assurance level mapping is what prevents duplicate prompts across mixed authentication paths. This is why option D is the best answer in Salesforce terms.