When it isn't practical to integrate all corporate apps with SSO, it's still possible to adopt an overlay solution, that is integrated with SSO, providing MFA and central access and control to applications.

Attackers spam users with MFA push notifications, until they finally accept by error or just because they are overwhelmed. This is becoming more common way of bypassing MFA.