MFA on Windows 10 over RDP

Hello,

We have a bunch of Windows 10 desktops that our admins use for their privileged work. The admins use their dedicated admin accounts to log onto them and they use RDP to make the connection. The desktops run Windows Enterprise and they are hosted on-prem.

We want to somehow put MFA on that RDP connection.

I have looked into Windows Hello for Business but this doesn't seem to suit this particular scenario (please correct me if I'm wrong about this).

We could buy something like Duo or Okta (lol) to do it, but since we pay so much for MS licencing already, I was hoping that it could be done natively. For example, could it be achieved with the NPS extension for Azure MFA?

Any suggestions very much appreciated.