Once booted into MS Windows, click on Start à Settings 
à Accounts à Sign In Options.
Here you can configure an additional MFA option for your second factor in Windows Hello for Business.
It’s also recommended to pair your smartphone with the device’s Bluetooth connection as a secondary factor of authentication.
To do this, click on Start > Settings 
> Devices 
>
Important Notes:
- Unless using a Smart Card or Security Key, the first MFA factor must be PIN, facial recognition, or fingerprint. The second factor will be either a trusted signal, or a PIN (if not used as first factor). If logging in with a Security Key, the key itself, plus pressing the security key activation button, in conjunction with the PIN satisfy the MFA for Windows login.
- Notify your CSP once all users have configured Windows Hello for Business so that MFA enforcement can be enabled.