To secure Windows logon with Azure AD user accounts, you first need to set up MFA for Office 365 with WS-Federation. 

User Experience




Troubleshooting Reference:

Troubleshoot hybrid Azure AD-joined devices