If for some reason, possible due to a submitted Fraud alert or when setting up initial MFA configuration something went wrong and the user got in a blocked/inconsistent MFA state, the user won’t be able to login.
Read more at source: http://blogs.technet.com/b/tfg/archive/2015/12/02/english-unblocking-mfa-for-an-o365-aad-user.aspx