One we hit inside Modality, we’re currently in hybrid between SfB Online and SfB Server, when enabling users for Office 365 Multi-Factor Authentication
Credit to Internal IT and Microsoft for solving this one. It is documented in this article: https://support.microsoft.com/en-in/help/3082803/info-about-the-allowadalfornonlyncindependentoflync-setting-in-skype-f
We added the following registry on your computer and rebooted it.
For Skype for Business or Lync 2013 clients 16.0*:
HKEY_CURRENT_USER\Software\Policies\Microsoft\Office\16.0\Lync
Then, apply the AllowAdalForNonLyncIndependentOfLync registry key setting:
“AllowAdalForNonLyncIndependentOfLync”=dword:00000001
Once this was added, users were not prompted.