Microsoft Entra ID Security Defaults | Microsoft Entra ID Conditional Access
portal.azure.com > Microsoft Entra ID > properties
scroll to bottom.
enable security defaults.
This will enable the default settings for most SMB's and possibly higher.
If needed, a large company can upgrade to Conditional Access for fine grain control.
https://learn.microsoft.com/en-us/entra/fundamentals/security-defaults
Be sure your MFA options are selected here