Microsoft 365 Security Default MFA Concerns?

Has anyone observed any inconsistencies with the MFA enforcement under Microsoft 365's security defaults? In some cases, users can log in without being prompted for MFA, especially when using test accounts on VMs or Sandboxes. Despite having security defaults turned on, these logins sometimes bypass MFA.

I know that conditional access policies offer a more reliable solution, but not everyone opts for them. I'm curious if others have faced similar issues and if there are specific factors, like …

access accounts bypass can cases conditional conditional access cybersecurity default enforcement log logins mfa microsoft microsoft 365 microsoft 365 security offer policies sandboxes security test under using vms