Problem solved. Ahmed @ Microsoft explained why this was happening for us in this article:
Azure Dummies – 28 Apr 19
Azure AD Judgment when InsideCorporateNetwork Claim with ADFS is Used
Hello Team, Today we will go through a s...
Glitch,
Thanks for the reply.
We actually leave our Trusted IP list completely empty. You might ask yourself, well then how do you assert that you are from a trusted location? That is where the AD FS “Inside Corporate Network” Claim comes into play.
...
We have been battling a very similar issue for about two months now.
We want to be able to roll out Duo MFA to our users, and we want it to work in conjunction with our on-prem ADFS (using the Duo AD FS MFA Adapter / Duo Authentication for AD FS 1.2....
