MTR account security best practices

When we set up Teams Rooms devices a few years ago, the best practice for account security at the time was to use individual resource accounts coupled with Conditional Access Policies that restrict the accounts to only be allowed to sign in on specific named/trusted network locations. At the time, MFA was discouraged as a complicating factor in the MTR authentication flow.

With Microsoft's recent push to increase companywide security with a focus on MFA, have any best practices changed to include MFA for MTR accounts?