What is the best practice for setting up Windows logon with 2FA with Azure credentials? Do we need to install an application on every device?