The user can bypass MFA in case of VPN authentication configured on the login screen. To prevent MFA bypassing for VPN authentication, perform the following steps:
Navigate to %appdata%\Microsoft\Network\Connections\Pbk directory.
Open the.pbk file in Notepad.
Set the parameter UseRasCredentials to 1. (default value is 0).
Save the changes and close the file