Setting up a service for more than one factor of authentication can be complex. Using Azure AD, however, it is very simple and easy to enable, as you can see in the following diagram:

If you own the proper SKU of Azure AD, the process will be just a few clicks away:

As you can see, Azure MFA includes fraud detection. This means that if a user logs in in different regions of the world (let's say, America and Asia) within minutes of each other, it will appear as potential fraud, and the user will be blocked automatically.

MFA can be enabled per user from the Azure Portal, as follows:

This leads to a specific page, with the options for MFA itself, as follows:

Now, Azure MFA is up and running for the chosen user accounts.