There are two ways to configure MFA on Azure/Office365. You can set it up globaly for the whole tenant or only specific for the Workspace 365 oAuth application.

Office 365

To enable MFA for your whole Office 365 tenant follow this guide:

https://support.office.com/en-us/article/Set-up-multi-factor-authentication-for-Office-365-users-8f0454b2-f51a-4d9c-bcde-2c48e41621c6

Workspace 365 Azure AD application

To enable MFA for the Workspace 365 Azure AD application you can follow this guide:

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-conditional-access-azure-portal

With this implementation you can enforce conditional access and set additional policies on the Workspace 365 Azure AD application.