Would P1 or Business Premium be worth it for this nonprofit?

First check whether Security Defaults are enabled in the tenant. They may give you a way to require MFA without moving everyone to Conditional Access, and they can be a practical starting point when budgets are tight. Review what they change and test the impact on sign-ins and existing authentication setups before switching them on.

I wouldn’t build Conditional Access policies around accounts that aren’t properly licensed for them. Check the current Microsoft licensing terms and the nonprofit grants for your tenant, then price eligible licenses or suites. If Conditional Access is a requirement, get the licensing in place rather than treating noncompliance as an informal workaround.

Don’t assume every account needs the same upgrade. Work out which staff and volunteer accounts need stronger controls, then compare the eligible nonprofit Business Premium offer with your existing plan costs. If volunteers can stay on Basic and use a tenant-wide option that meets your needs, that could avoid paying for a broad upgrade. Confirm the grant details with your licensing provider.

Per-user MFA might be a short-term fallback, but I’d avoid making a script the security plan. It’s harder to manage cleanly than a tenant-level policy, and it doesn’t give you the same flexibility as Conditional Access. Whichever route you take, make the change visible to users and have a way to handle sign-in problems.