I know this is probably not the best place to ask this question. But, after days of working on this, and having posted in the Microsoft Forum, I'm at my wits end.
We are utilizing a hybrid ADFS 4.0 (Server 2016) / Azure AD / Office 365 setup with device registration and SSO working.
We are attempting to enable multi-factor authentication with device based access policies. We don't want "recognized" devices seeing additional MFA prompts. We are evaluating the claims being returned by ADFS using the Microsoft Claims Xray.
We have successfully enabled MFA and configured ADFS to only prompt for MFA if a device is unrecognized. This works because devices that are recognized have additional properties in active directory (isRegisteredUser; isManaged; isKnown; trustType; etc) and we can take action on those properties. We've tested with IE, Firefox, Chrome, and Safari on an iPad. However, the "DeviceContext" claims only come through when the authentication is done from IE or Safari on the iPad.
For some reason, it appears no device authentication occurs when the request is made from Chrome or Firefox. Authentication works, we just can't see any of the devicecontext claims that allow us to make a decision based on if the device is registered or not. So, these browsers get an additional MFA prompt.
I simply cannot find any posts online matching my exact problem. There are a few threads that are similar, but turn out to be different issues, or end up at a dead end. I'm hoping someone has this similar setup and knows why Chrome and Firefox would not perform the additional device based authentication, but safari on an iPad would. All the devices have valid certificates to perform the authentication.
I don't get any errors to go on in any event logs. The browser simply doesn't make a device authentication request, and no devicecontext claims are issued. It's possible this isn't supported, but I can't find any information indicating one way or another.