MFA for AnyConnect Issue

Hi Folks,

I'd like to test Azure MFA for anyconnect by setting up a new tunnel-group and giving it SAML authentication.

Currently we have a primary tunnel-group called (and aliased) 'anyconnect'. Users connect to it by connecting to 'https://sslvpn.companyname.org'.

I then create a new tunnel-group called 'anyconnect_mfa' with SAML auth, aliased and with a group-URL 'https://sslvpn.companyname.org/anyconnect_mfa'.

The issue is that as soon as I do this, when anyconnect connects to the standard 'https://sslvpn.companyname.org' url, I get the SAML auth popup, instead of the old username/password box.

What has caused the new tunnel-group to supersede the old one?

I'm assuming there's something fairly basic I've missed.