SSO works but step-up MFA never triggers

Primary authentication succeeds, yet privileged actions remain exposed because the application is still reading an outdated assurance claim.