Hi @ysharat,
I recommend checking out this example on how to trigger MFA.
And then, to check for the user behavior, you can look for any of the properties in the Actions Triggers: post-login - Event Object.
Let me know if you have any further questions.
Cheers
Rueben