The new Multi-Factor Authentication (MFA) recommendations a few reasons:
Incomplete or incorrect configuration: It's possible that MFA is enabled for the users, but some specific settings or configurations are not aligned with best practices, which could trigger these recommendations.
Scope of MFA: MFA can be enabled at different levels and for different resources within Azure. The recommendations you're seeing might be suggesting enabling MFA for specific resources or services that are not currently covered by the users' MFA configurations.
Conditional Access policies: Azure AD uses Conditional Access policies to enforce MFA under certain conditions. These recommendations could be related to improving or expanding existing policies to better align with best practices.
Legacy or deprecated settings: If the MFA configurations in place were set up a while ago, there might be new features or improvements that are not yet implemented. The recommendations could be suggesting an update to the latest and most secure configurations.
To address these recommendations, you should:
Review the MFA configurations for the users and resources in question.
Make sure MFA is properly enabled and configured according to the latest best practices.
Review and update Conditional Access policies to ensure they are comprehensive and effective.
Regularly monitor and audit MFA settings to maintain security and compliance.
Remember that security recommendations are designed to help you improve your security posture, so it's essential to evaluate them and take the necessary steps to address any potential weaknesses or gaps