MFA using Conditional Access Policy

Communication is key, as with most security-related issues. Once you start the rollout (or even some time before it), ask your users to go to aka.ms/proofup and configure their MFA details. As for checking, I guess the best way would be to check whether the relevant details are populated under StrongAuthenticationUserDetails. Although if the user has only configured the App, I don't think this will show there. Oh well, I guess once the new MFA/SSPR API is out we will have a better solution.