Client Credentials / JWT key generation with SSO Required and IdP MFA

We are using Box with SSO set to Required and MFA is enforced at our IdP.

When trying to view or regenerate a client secret (Client Credentials Grant) or generate a JWT key pair in the Developer Console, Box requires that the user has Box 2-Step Verification enabled.

However, when SSO is Required, the Box-native 2-Step Verification setting is not available in the user’s security settings.

Questions:

1. Can IdP-side MFA be recognized by Box as satisfying the “2-Step Verification” requirement for Developer Console operations?

2. If not, is it impossible to regenerate client secrets / JWT key pairs in an SSO Required environment without temporarily disabling SSO?

3. Is there an official workaround or supported procedure for this scenario?

We want to avoid relaxing SSO policies in production if possible.