Using biometrics, you can replace the 'something you know' authentication factor with the 'something that is part of you' factor, with the assurances that users can fall back to the 'something you know factor'. The user can also initiate the Windows Hello setup process from the Settings app at any time. A private key is created and registered in Azure AD.

With the proper hardware, you can enhance the user experience by introducing biometrics. During the next sign-in, the user is prompted to configure Windows Hello for Business, confirm their identity using multifactor authentication, and create a PIN. Windows Hello for Business incorporates two of these factors: something you have (the user's private key protected by the device's security module) and something you know (your PIN).

'Is Windows Hello for Business multifactor authentication? Windows Hello for Business is two-factor authentication based the observed authentication factors of: something you have, something you know, and something part of you. This authentication consists of a new type of user credential that is tied to a device and uses a biometric or PIN.' 'In Windows 10, Windows Hello for Business replaces passwords with strong two-factor authentication on PCs and mobile devices. It might not be the MFA solution you are looking for, but the closest solution currently available for MFA on Windows Login is Windows Hello for Business: 'MFA server will not provide Multi-Factor Authentication during Windows Login, only for Applications. I think windows hello is the only option at this time.

Azure mfa for windows login