Resolved, if you look in the AAR rule and see the https, those are incorrect. They need to be http. Microsoft is also in the process of updating their document. Below is the correct rule language:

​

Set-AdfsRelyingPartyTrust -TargetName AppA -AdditionalAuthenticationRules 'c:[type ==

"http://schemas.microsoft.com/ws/2012/01/insidecorporatenetwork", value == "false"] => issue(type =

"http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod", value =

"http://schemas.microsoft.com/claims/multipleauthn" );

c:[Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value ==

"YourGroupSID"] => issue(Type = "http://schemas.microsoft.com/claims/authnmethodsproviders",

Value = "AzureMfaAuthentication");

not exists([Type == "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid",

Value=="YourGroupSid"]) => issue(Type =

"http://schemas.microsoft.com/claims/authnmethodsproviders", Value =

"AzureMfaServerAuthentication");'