Assessor verifies that MFA is enforced for all admin accounts and all users on cloud services by inspecting policy and attempting sign-in.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.