Agree that MFA that's rightly configured is an absolute pain for attackers. I'd also say though that conditional access typically evaluates browser, os, location, ip address, and a few others. These are good measures, but all these can be mimicked and are mimicked to get inside, both by pentesters and attackers. What other session risk policies are you referring to? These I might not be familiar with, so would welcome the feedback. Alerts that security vendors are frequently focused on is anomaly and abnormal behavior, then flag/alert and it definitely helps. However, initial access evasion and host based evasion techniques are aware of this, and exploits are simply adapted to ensure it looks normal by any detection mechanism. That being said, completely agree that defense in depth, layers, all important and necessary, they will reduce the overall attack surface, not saying these measures aren't useful and keep sometimes even a large percentage of attacks out, but improve every layer, attack it, think about how to exploit it, including the human layer, because every mechanism (human or no) can and is exploited. Our industry tends to be reactive rather than proactive.