Scope
Exchange Control Panel (ECP) uses Outlook Web Access (OWA) logon UI to verify users. If you enable 2FA on OWA then ECP logon will be automatically secured by 2FA.
However, if you want to enable 2FA on ECP only without OWA, then please follow this guide. Enable 2fa Access to ECP Admins only. Access will be denied to non administrators.
Prerequisite
If you have not already done so, please refer to links below on DualShield Server and IIS agent setup.
...
Create an ECP Admins group in AD and make your ECP Administrator accounts members of this group
Steps
1) DualShield Server Configuration for ECP Access
...