MFA regression (admin and user):

Hardcoded logic based on the following:

Logic is not evaluated at the time the integration/feature enablement. We don't want to hammer your inbox with notifications for nothing
Daily comparisons evaluated(previous days record at scan time vs new record at scan time)
Alert is sent if a previous days record was compliant (MFA required) and the new record is non-compliant (MFA not required). **Note here that while the risk delta could have regressed by a user no longer requiring MFA, they could still be enrolled, but the lack of requirement means they could also disable MFA, leaving a security risk. This is why we chose to focus on MFA required vs enrollment, as MSP's typically are in control of enforcing the requirements
When a new user is added to the environment without MFA requirement, a notification will not be generated, as that is their baseline state. This avoids unnecessary notifications for things like Service Accounts.

What are MFA alerts