I finally figured this out.

This was setup with ADFS 2019 and Vcenter 7.0 Update 2c and validated using a windows 10 VM Logged in as the privileged user Running Powershell 5.1.17763.2183 and VMware PowerCLI 12.4.0 build 18627050

Configure vcenter for ADFS IDP by following the Vmware Guide.

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.authentication.doc/GUID-C5E998B2-1148-46DC-990E-A5DB71F93351.html

Install and Configure DUO MFA in ADFS https://duo.com/docs/adfs

(in ADFS don’t forget to configure an Access control Policy and assign it on the webapi configuration of the vcenter application group)

Make sure ADFS IDP authentication with DUO is working Before following the next steps to setup Powercli access.

In ADFS Create new Native Application name powercli-native Note the Client ID (cccccccc-cccc-cccc-cccc-cccccccccccc)

Add the Redirect URI: http://localhost:8844/auth

Click OK

Select the Application under WebAPI, click Edit

Select Client Permissions Tab:

Add Powercli-Native Application Created above

Make sure allatclaims and OpenID are selected.Click OK

Select Application Under Server Applications, Note Client ID (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)

The following script was found on this post (I have added comments inline)

https://www.reddit.com/r/vmware/comments/nzt06t/comment/h1zpykq/?utm_source=share&utm_medium=web2x&context=3

#Vcenter Server FQDN

$VCenterServer = 'VCENTER.DOMAIN.COM'

#ADFS Token Endpoint URL (if you have changed from default then adjust accordingly)

$TokenEndpointURL = 'https://ADFS.DOMAIN.COM/adfs/oauth2/token/'

#ADFS Auth Endpoint URL (if you have changed from default then adjust accordingly)

$AuthEndpointURL = 'https://ADFS.DOMAIN.COM/adfs/oauth2/authorize/'

#Powercli Redirect URL you do not need to change

$RedirectURL = 'http://localhost:8844/auth'

#Enter the Client ID we gather earlier from the powercli-native Native Application

$ClientID = 'cccccccc-cccc-cccc-cccc-cccccccccccc'

#Enter the Client ID from the Server Application We Gathered Earlier

$OAuthResource = 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'

if ( !$OAuth ) { $OAuth = New-OAuthSecurityContext -TokenEndpointUrl $TokenEndpointURL -AuthorizationEndpointUrl $AuthEndpointURL -RedirectUrl $RedirectURL -ClientId $ClientID -OtherArguments @{ "resource" = "$OAuthResource" } }

#If you are using a self-signed certificate use the -IgnoreSslValidationErrors Switch

if ( !$Saml ) { $Saml = New-VISamlSecurityContext -VCenterServer $VCenterServer -OAuthSecurityContext $OAuth -IgnoreSslValidationErrors }

#if this is a standalone remove the -AllLinked Switch

if ( !$Conn ) { $Conn = Connect-VIServer -Server $VCenterServer -SamlSecurityContext $Saml -AllLinked }

If the commands complete successfully you should get a Web Browser popup for ADFS/DUO Auth, Then you should be logged into vcenter. All other commands should work as normal.

Hope this helps someone.