Can mfa-delete be enabled with external IdP users?

Hi there! Good question, and the simple answer is yes, you can enable mfa-delete with external IdP users, but you need to configure some additional steps. I've tried to break this down into some steps you can test/implement.

1. First, you need to connect your external IdP to AWS IAM Identity Center (successor to AWS Single Sign-On) using SAML 2.0 protocol1. This will allow your users to sign in to the AWS access portal with their existing credentials from the external IdP.

2. Second, you need to provision your users and groups from the external IdP into IAM Identity Center before you can assign them permissions to AWS accounts or applications. You can do this manually or automatically using SCIM.

3. Third, you need to enable mfa-delete on your S3 buckets using the AWS CLI or the API. You also need to associate your buckets with an AWS service that supports MFA delete, such as Elastic Load Balancing or CloudFront.

4. Fourth, you need to obtain the device serial number and the authentication code from your external IdP when you perform any operation that requires MFA delete, such as deleting a version or changing the versioning state of a bucket. You can use the AWS CLI or the API to pass these parameters along with your security credentials.

Let me know if you have any issues with this, or if it helps you then please accept my answer after you've tried it out - it would be much appreciated! Good luck :)