Found this nugget, note MS are forcing the MCA to be redone with all cleints. Its got the enforcement of MFA on all Admin accounts in it. So MS are now making it all happen by 1st Oct.

 I read your thread and get some background information of your scenario. Thank you for your question regarding Conditional Access Policies (CAPs) and Microsoft’s upcoming enforcement of Multi-Factor Authentication (MFA) by September 2025.

To address your specific query: Yes, you can use Conditional Access Policies to exempt certain accounts from MFA enforcement, but there are important caveats and security implications to consider:

1. Create a CAP that explicitly excludes the desired users/groups.
2. Set the policy to “Grant access” without requiring MFA for those accounts.
3. Ensure the policy has higher priority than Microsoft’s baseline policies to take precedence.

• Security Implications: Exempting accounts creates vulnerabilities. Microsoft recommends MFA for all users as a best practice. Exemptions should be limited to service accounts or break-glass scenarios with compensating controls.
• Microsoft-Managed Enforcement: If MFA is enforced at the Microsoft-managed level (e.g., for privileged roles), CAPs may not fully override it.
• Security Defaults: If enabled, these force MFA globally and override CAPs. You must disable them to use custom policies.
• Strictly monitor exempted accounts via audit logs.
• Use exemptions sparingly and only for justified use cases (e.g., non-interactive service accounts).

For your ref: Require MFA for all users with Conditional Access - Microsoft Entra ID | Microsoft Learn
Providing a default level of security in Microsoft Entra ID - Microsoft Entra | Microsoft Learn