A baseline 'require MFA for all users on all apps' Conditional Access policy is the single most effective security control for an M365 tenant. Without one (and without Security Defaults), any user can sign in with just a password.
A scan reports where your tenant stands on this check — pass, fail with a step-by-step fix, or not applicable if your licensing doesn’t include the feature. When Tenant Strike can’t read a setting with read-only access, it says unverified and gives you a one-command way to confirm it yourself — it never guesses.
Check your own tenant
Is your tenant covered on "require mfa for all users"?
One read-only scan answers it — this check and every other one in the catalog, each with a plain-English fix. 7-day Pro trial, no credit card.