MFA and conditional access are assumed universal but aren't, so users, apps and services without strong authentication remain the soft targets. The gaps are exactly where attackers look.
"Which users, apps and services are still without strong authentication, and how exposed does that leave us?"
MFA coverage
Live coverage view
To first outcomes