In the 2FA instrumentation spec (restricted access), @nettrom_WMF writes:

Schema: account_conversion/current.yaml
Stream: mediawiki.accountcreation.login

Would require modification to also track MFA. It needs to track that an MFA challenge was issued, what type of MFA was used, and whether the challenge was succesful, failed, or the user chose to change to a different method.

and in reference to the same schema:

Same schema and stream as above. Requires modification to track the number of methods available at an MFA challenge so that we can distinguish between single and multiple method login attempts.

• Add 2FA challenge and switch events to the account_conversion schema
• Track which 2FA methods are available as part of these events