CBA, MFA, and AADSTS54008 Certificate is not supported as first factor

Also, if you you are getting that MFA sign in error regarding "first factor", and want it to work with CBA, you have to disable MFA enforcement at the user level and make sure they aren't included in any other conditional access policies that require MFA. Just make sure you have other user account protections such as additional Conditional Access Policies based on device or IP Range etc.