The security setting nobody knew was off

I reviewed a Microsoft 365 tenant recently where the business thought they had multi-factor authentication switched on.

They did. The policy was there. It looked correct. The admin had set it up eighteen months ago and assumed everything was fine.