To add some more information, I see that Microsoft indicates that "external multifactor authentication solutions and federated identity providers will continue to be supported and will meet the MFA requirement if they are configured to send an MFA claim".

The question is, how can we send the MFA claim with WS-Fed?

There is additional attribute that needs to be sent, I'll search for it tomorrow and let you know.

But in addition to that you also need to tell MS that IDP will provide MFA information, which can be done by running

Set-MsolDomainFederationSettings -DomainName <deferated domain> -PromptLoginBehavior Disabled -SupportsMfa $True

Please note that there is also MSGraph alternative for SupportsMfa, but I don't know it from top of my mind

Thanks!

I guess for MSGraph it must be the parameter federatedIdpMfaBehavior.

Yes. For attribute, you need to send attribute with name authnmethodsreferences with namespace http://schemas.microsoft.com/claims

This can be an array of authentication methods that user has performed. Might be enough to send value http://schemas.microsoft.com/claims/multipleauthn, but I just prepare virtual attribute with a bit more to be sure MS is happy:

Custom Javascript function that I use is following:

function main(P1){
	return returnAuthnmethodsreferences();
}
function returnAuthnmethodsreferences(){
	var result = ["urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport", "http://schemas.microsoft.com/ws/2012/12/authmethod/phoneconfirmation", "http://schemas.microsoft.com/claims/multipleauthn"];
	return result;
}

Mapping then looks like that:

I hope this helps

//s