Enforce MFA on MS Entra only for specific users

we're using MS Entra and we would like enable users to opt in for MFA (SMS verification) and to enforce MFA for Admins.

Is there a way to do it without creating custom policies?

We were thinking about creating two custom groups with one of them enrolled for MFA and second one without.

Any thoughts?

Initially, create one MS Entra group by adding those specific users as members for which you want to enable MFA:

In my case, I'm using conditional access policies to enable MFA for which either Microsoft Entra ID P1 or P2 license is required for tenant:

Now, create one conditional access policy with below options by selecting created group in Assignments tab:

Go to Azure Portal -> Microsoft Entra ID -> Security -> Conditional Access -> Create new policy

Make sure to select "Require multifactor authentication" under Grant access of Access controls as below:

To confirm that, I tried to login with one of the group members that asked for MFA successfully:

To enable MFA for admin users, you can refer this MS Document.