The gold standard approach would be to use Conditional Access based evaluation. You get some signals for free with premium P1 licensing but to get everything you'd need to change your pricing tier. Read more for B2C Identity protection here and evaluate the pricing tier at aka.ms/aadb2cpricing.

If that is not an option, you can either invoke MFA based on IP change and absolute time window or alternatively only MFA unknown devices using device fingerprinting.