OpenVPN with Azure MFA

[FelixCDA]

I have OpenVPN servers running which currently authenticate via LDAP with the on-premise Active Directory Domain Controller.
The local AD-DC is Microsoft Azure AD integrated.
Some users have MFA with the Microsoft Authenticator app enabled.
Is it possible to enable MFA for VPN connections? Goal is the user connects to the VPN, enters username and password and then the MS Authenticator app asks for approval and the user must click accept in the app to allow the VPN connection.
I couldn't find any information if this is possible and if yes, how.
If that is not possible I would also accept some TOTP that must support self-enrollment (like Sophos XG SSL-VPN).