What is the ideal frequency to require for MFA Tokens?

We want to implement MFA for VPN access - SAML integrated to Azure AD which trigger MS Authenticator app on the smart phone. My question has to do with the frequency with which the token should be needed? I see it can be required every hour. But that sounds like a pain for users. If you sent it once every eight hours or once a day instead of every hour, what are the security implications? Is it possible that you could log on with one laptop with MFA and then four hours later a hacker could log in with just your UID/AD Password because you'd already done your MFA for the day?