Disable MFA 14 day grace period?

# install Graph module before start
# Install-Module Microsoft.Graph -Scope AllUsers -Repository PSGallery -Force

Connect-MgGraph -Scopes "Directory.AccessAsUser.All"
$users = Get-MgUser -All | Select-Object UserPrincipalName, Id

# getting list of not enabled MFA users
$usersWithoutMfa = @()
foreach ($user in $users) {
    $userId = $user.Id
    $userUPN = $user.UserPrincipalName  
    
    Write-Host "Checking MFA status for user: $userUPN" -ForegroundColor Yellow
    
    # Fetch the user's MFA status
    $mfaStatus = Invoke-MgGraphRequest -Method GET -Uri "/beta/users/$userId/authentication/requirements"
    $mfaStatus.perUserMfaState
    # Check if MFA is already enabled
    if ($mfaStatus.perUserMfaState -in @('enabled','enforced')) {
        Write-Host "MFA is already enabled for user: $userUPN" -ForegroundColor Green
    } else {
        Write-Host "MFA is not enabled for user: $userUPN. Enabling now..." -ForegroundColor Red

        $usersWithoutMfa+=$user
    }
}

$usersWithoutMfa.count
$usersWithoutMfa.UserPrincipalName

# Set MFA
# Go through each user and enable MFA
foreach ($user in $usersWithoutMfa) {
    $userId = $user.Id
    $userUPN = $user.UserPrincipalName  
    Write-Host "Enabling MFA for user: $userUPN" -ForegroundColor Green
    
    # MFA status
    $body = @{
        "perUserMfaState" = "enabled"
    }

    # Invoke the request to update MFA status
    Invoke-MgGraphRequest -Method PATCH -Uri "/beta/users/$userid/authentication/requirements" -Body $body
}

Write-Host "MFA status has been enabled for all users." -ForegroundColor Cyan

Or use some powershell script like this to get a list of not MFA enabled users and enable MFA for them

You can manually enforce MFA for some user via
Per-user multifactor authentication - Microsoft Entra admin center 

luke_m137 

You need Identity Protection in order to get the 14-day grace period, and Identity Protection requires an Azure AD Premium P2 license. If you are premium user then MFA will be enforced once you enable MFA via conditional access then the user cannot bypass it 

https://docs.microsoft.com/en-us/azure/active-directory/identity-protection/overview-identity-protection

This is discussed by a content author in this Github issue:

Security defaults will trigger a 14 day grace period for registration after a user's first login and security defaults being enabled. After 14 days users will be required to register for MFA and will not be able to skip.

Conditional Access by itself without Azure Identity Protection does not allow for the 14 day grace period. Identity Protection includes the registration policy that allows registration on its own with no apps assigned to the policy. If a Conditional Access policy requires Multi-Factor Authentication then the user must be able to pass that MFA request.