Does SSO support multi-factor authentication from my identity provider?

Yes. When SSO is not required, users can choose to use SSO or standard email-password authentication.