docs: add entra / azure mfa docs

docs/documentation/platform/mfa.mdx

@@ -17,3 +17,40 @@ Check the box in Personal Settings > Two-factor Authentication to enable email-b
   building support for other forms of identification via SMS and Authenticator
   App.
 </Note>
+
+## Entra ID / Azure AD MFA
+
+<Note>
+    Before proceeding make sure you've enabled [SAML SSO for Entra ID / Azure AD](./sso/azure).
+
+    We also encourage you to have your team download and setup the
+    [Microsoft Authenticator App](https://www.microsoft.com/en-us/security/mobile-authenticator-app) prior to enabling MFA.
+</Note>
+
+<Steps>
+    <Step title="Open your Infisical application in the Microsoft Entra Admin Center">
+        ![Entra Infisical app](../../images/platform/mfa/entra/mfa_entra_infisical_app.png)
+    </Step>
+    <Step title="Tap on Conditional Access under the Security Tab">
+        ![conditional access](../../images/platform/mfa/entra/mfa_entra_conditional_access.png)
+    </Step>
+    <Step title="Tap on Create New Policy from Templates">
+        ![create policy](../../images/platform/mfa/entra/mfa_entra_create_policy.png)
+    </Step>
+    <Step title="Select Require MFA for All Users and Tap on Review + Create">
+        ![require MFA and review policy](../../images/platform/mfa/entra/mfa_entra_review_policy.png)
+        <Note>
+            By default all users except the configuring admin will be setup to require MFA.
+            Microsoft encourages keeping at least one admin excluded from MFA to prevent accidental lockout.
+        </Note>
+    </Step>
+    <Step title="Set Policy State to Enabled and Tap on Create">
+        ![enable policy and confirm](../../images/platform/mfa/entra/mfa_entra_confirm_policy.png)
+    </Step>
+    <Step title="MFA is now Required When Accessing Infisical">
+        ![mfa login](../../images/platform/mfa/entra/mfa_entra_login.png)
+        <Note>
+            If users have not setup MFA for Entra / Azure they will be prompted to do so at this time.
+        </Note>
+    </Step>
+</Steps>

docs/documentation/platform/sso/azure.mdx

@@ -116,3 +116,7 @@ description: "Learn how to configure Microsoft Entra ID for Infisical SSO."
    - `AUTH_SECRET`: A secret key used for signing and verifying JWT. This can be a random 32-byte base64 string generated with `openssl rand -base64 32`.
    - `SITE_URL`: The URL of your self-hosted instance of Infisical - should be an absolute URL including the protocol (e.g. https://app.infisical.com)
 </Note>
+
+<Note>
+   If you'd like to require Multi-factor Authentication for your team members to access Infisical check out our [Entra ID / Azure AD MFA](../mfa#entra-id-azure-ad-mfa) guide.
+</Note>

frontend/src/views/Settings/OrgSettingsPage/components/OrgAuthTab/SSOModal.tsx

@@ -30,7 +30,7 @@ enum AuthProvider {
 
 const ssoAuthProviders = [
   { label: "Okta SAML", value: AuthProvider.OKTA_SAML },
-  { label: "Azure SAML", value: AuthProvider.AZURE_SAML },
+  { label: "Azure / Entra SAML", value: AuthProvider.AZURE_SAML },
   { label: "JumpCloud SAML", value: AuthProvider.JUMPCLOUD_SAML },
   { label: "Keycloak SAML", value: AuthProvider.KEYCLOAK_SAML },
   { label: "Google SAML", value: AuthProvider.GOOGLE_SAML }
@@ -161,7 +161,7 @@ export const SSOModal = ({ popUp, handlePopUpClose, handlePopUpToggle, hideDelet
           entityId: "Identifier (Entity ID)",
           entryPoint: "Login URL",
           entryPointPlaceholder: "https://login.microsoftonline.com/xxx/saml2",
-          issuer: "Azure Application ID",
+          issuer: "Azure / Entra Application ID",
           issuerPlaceholder: "abc-def-ghi-jkl-mno"
         };
       case AuthProvider.JUMPCLOUD_SAML: