Connect-PowerBIServiceAccount fails when MFA is enabled for PowerBI

My organization has MFA enabled for PowerBI. When I execute the below script to login to powerBI as a user (not an SPN), AzureADWindowsAuthenticator displays an error, along with the following stack trace. The same script works fine on a test account in a different tenant where MFA is not required for PowerBI. We're going to try an SPN next as a workaround.

Lastly, this occurs right after our following ADFS endpoint is called:
POST https://adfsserver.company.com//adfs/services/trust/2005/usernamemixed ; an HTTP 200 is returned but the body of the XML states failedAuthentication, reason MSIS7068: Access denied..

`$DebugPreference ='Continue';

$Username = 'user@company.com';

$Pwd = 'passwordgoeshere';

$p2 = ConvertTo-SecureString $Pwd -AsPlainText -Force

$cred = New-Object System.Management.Automation.PSCredential($UserName,$p2);

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12;

Connect-PowerBIServiceAccount -Credential $cred -Verbose`

DEBUG: 10:12:24 PM - Connect-PowerBIServiceAccount begin processing with ParameterSet UserAndCredential.
DEBUG: 10:12:24 PM - Cmdlet version: 1.0.487.0
Connect-PowerBIServiceAccount : Failed to get ADAL token: Unhandled Exception: System.AggregateException: One or more errors occurred. --->
Microsoft.IdentityModel.Clients.ActiveDirectory.AdalException: Device Certificate was not found for Cert
Authorities:OU=82dbaca4-3e81-46ca-9c73-0950c1eaca97,CN=MS-Organization-Access,DC=windows,DC=net
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Platform.DeviceAuthHelper.FindCertificateByCertAuthorities(IDictionary’2 challengeData,
X509Certificate2Collection certCollection)
At Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Platform.DeviceAuthHelper.FindCertificate(IDictionary’2 challengeData)
At Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Platform.DeviceAuthHelper.d__2.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Http.AdalHttpClient.d__25’1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Http.AdalHttpClient.d__22’1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Http.AdalHttpClient.d__21’1.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__72.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__69.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__59.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.Internal.Flows.AcquireTokenHandlerBase.d__57.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext.d__37.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContextIntegratedAuthExtensions.d__0.MoveNext()
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
at AzureADWindowsAuthenticator.Program.d__1.MoveNext() in C:\projects\powerbi-powershell\src\Common\AzureADWindowsAuthenticator\Program.cs:line 33
--- End of inner exception stack trace ---
at System.Threading.Tasks.Task.ThrowIfExceptional(Boolean includeTaskCanceledExceptions)
at System.Threading.Tasks.Task’1.GetResultCore(Boolean waitCompletionNotification)
at System.Threading.Tasks.Task’1.get_Result()
at AzureADWindowsAuthenticator.Program.Main(String[] args) in C:\projects\powerbi-powershell\src\Common\AzureADWindowsAuthenticator\Program.cs:line 18

Start with src/Common/AzureADWindowsAuthenticator/Program.cs at lines 18 and 33, then reproduce the Connect-PowerBIServiceAccount script with MFA enabled. Trace the ADAL device-authentication failure and the ADFS response shown in the issue; done means identifying and validating a supported resolution for this login failure.