Microsoft has done a lot of work to improve multi-factor authentication's resilience and capability.

You can enable it manually for each account. This is a mistake. Although it is simple conceptually, it is too easy to forget accounts. It will also require too much maintenance as users move on. This is a poor suggestion and I will not officially consider it a way to start.

Second, if you are using Microsoft 365 Business E3, E5, MFA is either on for everyone or disabled for everyone. This is a way to get started. However, it may not be what you wanted.

Microsoft's "Security Defaults", a feature Microsoft introduced in 2019, is the best way to start. Good news if your tenant was created after that date. In this case, you don't have to do anything. It's easy and simple to set it up if you don't have a tenant yet. Microsoft even states that security defaults can be used by organizations that want to improve their security posture, but don't know where or how to begin.

The other real way to get started is to visit www.office.com/setup. This is more complicated than security defaults.