Office 365 MFA to Duo Security Phased Migration

I trying to find some info about phased approach to migrate from a Offce 365 implenentation with ad sync and MFA from microsoft.
We will use DUO DAG and AD sync.

It’s possible to activate duo security for a portion of office 365 accounts or the setup is all on or off?
Where I define the accounts that use duo security and accounts that use office 365 MFA, in duo or microsoft ?

Are you using ADFS by any chance? It’s super easy to phase Duo in that way.