The AD FS service account account must be a member of the PhoneFactor Admins group in Active Directory. Membership in this ...