However, this isn't something AD FS does out of the box it is up to each Multi-Factor service to create that plug-in. The article you linked to is a proof of concept of one such attempt. Put the two together, and it should be possible (though certainly not trivial) to use Google Authenticator as a MuliFactor provider with AD FS. Additionally, Google Authenticator supports the TOTP standard for multi-factor authentication. One of these is the ability to create your own Multi-Factor Authentication providers. While it's primarily used with Active Directory, AD FS is also designed to function as a more generic SAML service you can connect it to other identity providers than Active Directory, and it supports many different options and extensions. Now, that doesn't mean what you want to do is impossible. (Note: I don't think Google supports this, but they should). If you did anything, it would be configuring Google to require Authenticator as a supplemental identity confirmation on top of (but separate from) AD FS or other SAML identity providers. When using AD FS with Google, you're not really using Google's Identity Provider anymore, and by the time AD FS completes the hand off back to Google, the identity side is already finished. Maybe you can see now how it doesn't really fit in with AD FS. Google Authenticator, on the other hand, acts as one factor of an Identity Provider.

Put the two together, so Google will trust your server's SAML token, and you're logging into a Google Account via Active Directory credentials. Google already has the ability to act as a SAML Service Provider. It will connect to Active Directory to use it as a SAML Identity Provider.

Google authenticator windows