Phishing and Email Security

A user in our org was phished.  We are making changes on swapping to phishing resistant MFA but what I am more concerned about is how Microsoft didn't catch the email with the malicious attachment.  ...