You are implementing Azure AD B2C for a consumer-facing app. Requirements: integrate a corporate SAML identity provider (IdP), enrich tokens with attributes from your REST API during sign-in, and enforce MFA only when users sign in via the corporate IdP. What should you do?

The correct option is to implement Identity Experience Framework (IEF) custom policies. IEF provides the flexibility needed to integrate a corporate SAML IdP using a SAML technical profile, enrich tokens with data from a REST API via a REST API technical profile, and conditionally enforce MFA within a user journey based on the IdP used. User flows, while simpler, do not offer the granular control required for conditional MFA based on the IdP or advanced token enrichment from external REST APIs. Azure AD Conditional Access is not directly applicable within an Azure AD B2C tenant for these specific scenarios. Configuring an Azure AD enterprise application for the SAML IdP is a step, but it doesn't address the token enrichment or conditional MFA requirements, and the resource owner password flow is generally not recommended for new applications due to security concerns and doesn't solve the core problem.