Defender or Sentinel alerting for when MFA devices are added?

It seems like a really strange omission, so I thought I would ask here. Are there any logs that are searchable with Advanced Hunting queries or through Sentinel Log queries to alert when users add/change/delete MFA devices? I'd love to get more specific and say, alert when other items match a critieria, such as from a Russian IP or from an IP associated with a virtual host provider, but really, any way to access more insights on this would be great.

Any ideas?

Also is there a better sub for this? Sentinel is an Azure tool, hence looking here. Thanks!