Is Security defaults enabled?
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
or a conditional Access policy requiring MFA?
Is MFA registration required?
https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy