MFA for OWA(Exchange 2016 iApp)

Hi all,

 

We recently deployed APM for Exchange 2016 iApp in our production. There is a new request from security to integrate MFA (something like Azure) for OWA! from a quick read I figured we can actually integrate Azure and APM but I was wondering since we've published all services under the same VIP how would it work? how can we say hey don't use MFA for autodiscover but use it for OWA? I'd appreciate any help.