For Entra ID joined PCs, you can use DualShield to authenticate users with MFA. Below is the architecture and data flow of this setup:
B1 - User On-Prem AD as the Identity Source

C1 - Use Azure AD as the Identity Source

To configure Entra joined PCs to use DualShield MFA, follow the steps below: