This message was deleted.

To create a seamless user experience you need to switch to SAML and Citrix FAS. What you could do : create a custom link on the logon page with a URL for example „Please enroll your token before logging in“.

Are the MFA and non-MFA users defined by groups? If so you could do a group membership check with nFactor first?

Custom Link: https://aka.ms/mfasetup