Conditional Access vs enable MFA

Neil Goldstein 
One advantage of using just CA policies: User won't have to set up App Passwords for Legacy Apps. I think iirc, App Passwords are required if you use Enable MFA for apps like Outlook and Skype, even PowerShell... make sure one account doesn't have MFA enable just in case there is another MFA outage (follow best practice for non-MFA account, i.e. setup CA policy for trusted IPs only).

Additionally, you'd want to create a few CA policies to avoid compromise accounts... yes, it is nice not to deal with App Passwords, but then attackers can use Outlook to login as bypass to MFA. So set CA policies for that, like block if sign in is from high risk location/countries or not included in trusted IP/location.