Azure Active Directory on ASP.NET Core - OAuth only for some users?

Question

Hi all;

Is there a way to use Azure Active Directory with my ASP.NET Core app for the authentication/authorization so that:

1. Regular users can log in via OAuth or create a user in Active Directory
2. Admin users must create a user in Active Directory (i.e. no OAuth) and require 2FA for their login

I'm fine if regular users that create a user in AD have to use 2FA. I'm also fine if they don't.

The reason for this is we want to make it as easy as possible for regular users to log in to our system and a regular user getting hacked is not a significant problem. But an admin getting hacked would be a serious breach and so I want to force 2FA for them.

thanks - dave