You can now use XrmToolkit with MFA enabled Dynamics 365 organizations. There are 2 methods outlined below for being able to authenticate when MFA is enabled.
You can try the following for your 'App Id' and 'Return URL'
These values should be global to all CRM online instances.
Alternatively, if you can register your own app in Azure. An excellent article can be found here for configuring an Azure Application that can be used for MFA authentication.
Once your Azure App has been registered, you can specify the 'MFA App Id' and 'MFA Return Url' in the new 'Advanced' tab on the authentication dialog:
Another option when MFA is enabled is to use Azure App Passwords instead of your regular password. This can be accomplished by following the details here: Azure App Passwords. After creating a new password, use this as your password in the authentication dialogs in XrmToolkit.