Why my authentication method does not work for my VPN Connection (Employees)?

You MUST have your DEFAULT MFA authentication method set to either:
App based authentication – notification OR Phone – call.
Text message (SMS) or Security Key/Hardware Token methods are NOT currently supported.
You can change your default authentication method by signing in to:
https://mysignins.microsoft.com/security-info