I am starting to see the challenge of this.
Duo will add MFA to OWA, but not Outlook Anywhere or Exchange Activesync.
UserLock will add MFA to OWA and Outlook Anywhere (with add-on), but not Exchange Activesync.
Hybrid Modern Authentication works for Outlook on desktop and mobile, but not with OWA.
Deepnet's product is the only way to protect all three scenarios that I have found so far.