azure active directory – How can I prompt the user for MFA every time they perform a sensitive action using Entra ID?

I’m experimenting with authentication contexts and conditional access (CA) policies using Entra ID.

When users sign into Azure, they are prompted for MFA.

But I want to prompt the user for step-up authentication (MFA), whenever they e.g. perform a sensitive operation in my application.

The problem is that the acrs claim is populated with the authentication context value when the client receives an access token for the resource (API). So, the API thinks I have already completed MFA and doesn’t send a claim challenge to instruct the client to request a acrs claim with this value using a claims request.

What can I do to prompt for MFA every time the user performs a sensitive action?