Lacking an enforced, tenant-wide MFA mandate enables single-factor sign-ins to M365 apps. Stolen or sprayed passwords can yield access, leading to data exfiltration, unauthorized changes, and outages. Report-only or scoped policies leave gaps that undermine confidentiality, integrity, and availability.

Enforce a Conditional Access policy requiring MFA for All users and All cloud apps. Exclude only break-glass accounts, favor phishing-resistant or authenticator methods, and avoid long-term report-only. Monitor sign-ins, review coverage regularly, and apply least privilege and zero trust to minimize exceptions.

• https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-azure-mfa
• https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength
• https://docs.azure.cn/en-us/entra/identity/conditional-access/policy-guests-mfa-strength