Identify AZURE AD users without OATH MFA configured

I have a need to identify AD users that have not set up MFA via the Microsoft Authenticator (or equivalent). How do I identify these users?

Presumably, the MFA OATH key is stored somewhere on the user account.