When a user that hasn't yet proofed up in Azure AD tries to authenticate with Azure AD Multi-Factor Authentication at AD FS, you get an AD FS error. Without support for inline proof, users must get proofed up by visiting prior to using Azure AD Multi-Factor Authentication to authenticate to AD FS applications.

Registering users for Azure AD Multi-Factor Authentication using AD FSĪD FS doesn't support inline 'proofup' (registration of Azure AD Multi-Factor Authentication security verification information such as phone number or mobile app). The Azure AD Multi-Factor Authentication adapter is built in to Windows Server 2016. Unlike with AD FS in Windows Server 2012 R2, the AD FS 2016 Azure AD Multi-Factor Authentication adapter integrates directly with Azure AD and doesn't require an on premises Azure AD Multi-Factor Authentication server. With AD FS, you can configure Azure AD Multi-Factor Authentication for primary authentication or use it as an additional authentication provider. Azure AD Multi-Factor Authentication enables you to eliminate passwords and provide a more secure way to authenticate. If your organization is federated with Azure AD, you can use Azure AD Multi-Factor Authentication to secure AD FS resources, both on-premises and in the cloud.

Process explorer technet