I ought to have clarified. DUO MFA comes into play with Outlook for our mailboxes that are in Exchange Online. On-prem mailboxes (the few we have left aren't subject to DUO).
Are those that are left on prem - are they actual users? If so, I'm curious why they can't be migrated?
Eventually all users will be migrated, so, yes, we still have real users on-prem.
This is outside the scope of the original question / scenario, but I've learned a good bit during this process with much of that learning validating a few things I already knew, such as the value of taking the necessary time to plan, and prep the environment for migration (removing unnecessary objects, etc.).
This is working on several machines now. But @romo reports that it is still hit or miss, it's not a reliable or permanent fix, but it more reliable than other attempts. It remains, as MS has stated, somewhat random.
I won't have any Win 7 systems by that time. At least that is the goal. I was thinking it was Jan 20, 2020. Guess I just confabulated that based on the year being 2020. Still have about 40 systems to issue to replace them.