CRM Connection String when using On-Premise IFD and MFA

Have recently converted an application that connects to Dynamics CRM to use the new CRM Tooling connection method. It used an old method of connecting to CRM and I needed to update the connection method to support modern CRM Online.

No problem with this part,

IOrganizationService _crmService;
string connectionString = "....my crm connection string....";
CrmServiceClient service = new CrmServiceClient(connectionString);
_crmService = (IOrganizationService)service.OrganizationWebProxyClient != null ? (IOrganizationService)service.OrganizationWebProxyClient : (IOrganizationService)service.OrganizationServiceProxy;

This all works and can connect to IFD On-Premise deployments and CRM Online.

IFD is connecting with a string in this format:

AuthType=IFD;Url=crmorg.crmprovider.com/CRMORG;Username=myuser@domain.com;Password=MyPass;Domain=LegacyDomain;

It can also support MFA with CRM Online by registering an app in Azure and configuring a connection string in this format:

AuthType=OAuth;Url=yourcrm.crm.dynamics.com;AppId=APPID;RedirectUri=http://localhost;

What I am stuck on, is the format of the string on an IFD (On-Premise) deployment using On-Premise Microsoft MFA.

When I use the OAuth method with Azure AD, the application pops up a Microsoft Sign in Assistant that handles the user/pass and two factor request.

How do I construct a CRM Connection string that will do the same with an On-Premise CRM365 Deployment using the latest ADFS and MFA components from Microsoft? I know that the On-Premise installation challenges your user/pass (via ADFS) like the Microsoft Sign in Assistant, but how do I invoke that method of connecting when not working with CRM Online?  Do i need to add an application to local ADFS?  I can't seem to find any guide or documentation on this.  There must be a way??!!