@vkc To clarify; for a while now, MFA has been on by default for M365 accounts, but individual users can turn it off or opt out and then turn it back on later if they want. The P1 and P2 licensing allows the tenant admins to make it absolutely mandatory, with no ifs and or buts, and enables some additional features related to Azure AD, not just the "Enforce MFA."

Also, are you surprised MS is gonna get paid?