The sad part is Microsoft has solved this. I just worked on their new MFA requirements for our schools MS 365 sub and it simply enforces MFA at first login. None of these bizarre lockout requirements.

Not having this feature has nearly doubled the calls to our service desk and resulted in hours of programming time to create custom patchwork solutions. This simple solution of enforcing enrollment at sign-in would solve the problem. If someone isn't...