I want to use the sso cookie to disable MFA via email, after user pressed on “keep me signed in”, entered email and password and verified once via email.

Following the docu
https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#configure-a-relying-party-file

keepAliveInDays

I can addjust keep alive days and the expiration date of the sso cookie changes accordingly

SSO-Cookie Expiration Date

If the user does not click on “keep me signed in” there will be also a sso cookie but without expiration date.

However, I’m using a verification step which I want to skip if there is this cookie with expiration date

<OrchestrationStep Order="9" Type="ClaimsExchange">
            <Preconditions>
              <Precondition Type="ClaimsExist" ExecuteActionsIf="true">
                <Value>isActiveMFASession</Value>
                <Action>SkipThisOrchestrationStep</Action>
              </Precondition>
              <Precondition Type="ClaimEquals" ExecuteActionsIf="true">
                <Value>authenticationSource</Value>
                <Value>socialIdpAuthentication</Value>
                <Action>SkipThisOrchestrationStep</Action>
              </Precondition>              
            </Preconditions>
            <ClaimsExchanges>
              <ClaimsExchange Id="EmailFactor-Verify" TechnicalProfileReferenceId="VerifyOTPUsingEmailAddress" />
            </ClaimsExchanges>
          </OrchestrationStep>

I was thinking about another precondition claim

<Precondition Type="ClaimEquals" ExecuteActionsIf="true">
                <Value>isPersistedSession</Value>
                <Value>true</Value>
                <Action>SkipThisOrchestrationStep</Action>
              </Precondition>

But have no idea how this claim is derrived from the sso cookie

• true = if existing, valid and not expired
• false = if expired, invalid or no expiration date is defined

Followed the docu on https://learn.microsoft.com/en-us/azure/active-directory-b2c/session-behavior?pivots=b2c-custom-policy#configure-a-relying-party-file but there is no information how to skip MFA.
Without MFA it works but this is a nogo for security reasons.

Any recommendations how to implement this precondition correctly?