Can I require a second factor on the VPN?

Yes, with Cisco Duo. Tick Enable Cisco Duo on the gateway and enter the integration key, secret key and API hostname from a Duo Auth API application. The person gets a push when they connect.

The push is sent last, after the certificate, the account and any group rules have passed. So nobody gets a push for someone else's revoked certificate, and a refused connection sends no push.

Before you turn it on: a device certificate is refused on a gateway that needs Duo, because a machine has no phone to send a push to. If Duo can't be reached, you choose what happens. Refuse is the default, or you can let people through and log it. That only applies when Duo is down. Set the gateway's RADIUS timeout to at least 60 seconds, so people have time to find their phone.

Microsoft Authenticator isn't an option. Microsoft doesn't offer a supported way to send an Authenticator prompt outside a sign-in. Conditional Access only runs during a sign-in, which a VPN connection isn't, and the older way of doing it has been retired. What's left needs either an on-premises server or a web browser, and an IKEv2 tunnel has no browser. We keep checking, and if it changes it'll appear here.