Azure determine via Conditional Access Policy if MFA is required or not ("RequireMFA"). Then Azure SSO delegates authentication requests to an OnPrem ADFS via WSFe