Why isn’t MFA working for my M365 Entra ID users?

I'm using Entra ID Free with security defaults turned on but I'm facing some issues with Multi-Factor Authentication (MFA). Here's the situation: I have no named locations or trusted IP ranges set up, and I've enabled organization-wide MFA. The migration from the legacy system is marked as complete. The users have an Exchange Online P1 license, MFA is enabled in Entra ID, and they get prompted to set up MFA. However, when I sign in to outlook.com from a new device at a different location and IP, I'm able to log in using just my email and password without any MFA prompt. I only get prompted for MFA when I try to change security settings for the account. What am I missing to ensure MFA is required for a simple login to Outlook? I haven't tested if other Microsoft services require MFA yet.