ADFS 2022 Smart Card Authentication No Longer Recognized as MFA After Upgrade from Windows Server 2016

Hello Bishnu,

Starting with 2019 you cannot use the same Authentication method on first and second factor as in 2016 and prior
ADFS treats CBA as a single factor auth by default and Multifactor means using two different credential providers and not one and the same.

you can override this by explicitly setting the MFA AuthMethodReference based on a claimrule during the processing of the Claims Provider Rules. So ADFS behaves similar to what you can configure in Entra CBA
eg:
MFA when the certificate is issued from a specific AuthorityIdentifier

@RuleName = "Mark CBA as Strongauth on AuthorityID"
c:[Type == "http://schemas.microsoft.com/2012/12/certificatecontext/extension/authoritykeyidentifier", Value == "KeyID=e80616c547112fd137b8124fb17969db2cd094c8"]
 => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsreferences", Value = "http://schemas.microsoft.com/claims/multipleauthn");

 MFA when the certificate is issued from a specific IssuerName

c:[Type == "http://schemas.microsoft.com/2012/12/certificatecontext/field/issuername", Value == "CN=2022ENTROOT, DC=contoso, DC=local"]
 => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsreferences", Value = "http://schemas.microsoft.com/claims/multipleauthn");

MFA when the certificate contains a specific KeyUsage

c:[Type == "http://schemas.microsoft.com/2012/12/certificatecontext/extension/eku", Value == "1.3.6.1.4.1.311.20.2.2"]
 => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsreferences", Value = "http://schemas.microsoft.com/claims/multipleauthn");

Plain simple AuthenticationMethodsProvider (not recommended)

c:[Type == "http://schemas.microsoft.com/claims/authnmethodsproviders", Value == "CertificateAuthentication"]
 => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsreferences", Value = "http://schemas.microsoft.com/claims/multipleauthn");