It is a requirement for Microsoft Partners to enable MFA for all users in organization, but as far as multi-tenant Azure AD MFA is concerned, Organizations can choose to enable/disable MFA for guests and single users.
Mostly organizations select MFA to be enabled for whole Azure AD while setting up tenant, which can be later enabled/disabled for individuals.
Let's focus on question"Why can a guest's home tenant not send some kind of attestation that MFA is in place on the home user account?"
One of the user to above question with in community speaks as follows:
“We have lots of our customers in our tenant as guests for Teams channels because we invite the customer primary contact(s) into a channel that has their support engineers present. When we switched on conditional access to enforce MFA on all users the guests got prompted to setup MFA even though they already have MFA on their home account.
For the time being I've added an exclusion on our conditional access policy to exclude guests and the dashboard is still saying we're 100% compliant after a few days, but what I'm reading here is that potentially these guest accounts are going to become useless unless all the guests wrestle with adding MFA on every instance they're a guest (which is totally mad).
We're not creating another tenant and shoving all our CSP stuff in there, it just adds so much friction and if anything reduces security because right now when someone joins or leaves our organization their Azure AD account sets up and cuts off their access to everything. If we begin having separate accounts in another tenant for CSP you can bet someone is going to forget to cut that off when someone leaves and access carries on until someone notices.
We are 100% on board with MFA being required, and I understand requiring MFA on a guest that doesn't reside in another Azure AD tenant (like a random @gmail.com user should be made to setup MFA), but where the user originates from Azure AD and has MFA on their home account, can it be that hard for MSFT to pass some kind of trusted flag across to the guest login that skips MFA if the home account has it?”
MY TAKE:
I understand requiring MFA on a guest that doesn't reside in another Azure AD tenant (like a random @gmail.com user should be made to setup MFA), but where the user originates from Azure AD and has MFA on their home account, can it be that hard for MSFT to pass some kind of trusted flag across to the guest login that skips MFA if the home account has it? In same thread another user shared a suggestion for this feature to be available, but link may have expired or feature no longer being considered.
