Office 365 Protection


I’m starting the process of protecting Office 365 logons (MFA). I have AD users and “cloud only” users.
I have DAG deployed. When I federate DUO with O365 what happens to the cloud only users?
If I want to have cloud users protected (MFA) too, what are my options?
Thank you.