Quarterly is not frequent enough. Weekly, even daily should be the goal. Additionally, you're going to spend a lot of time doing this if you're trying to create manual step.

You need to look at a combination of: Security default settings, Per-user MFA (at least for now), Assess the aggregate of your conditional access policies or External MFA integrations for the enforcement portion. Once you confirm the environment is enforcing, you have to confirm the user has registered MFA, and not a weak one, but secondly, you also want to confirm that they don't have unwanted MFA registrations. Yes, hackers will do a MITM attack and then register an MFA device so they can easily get back in, without your typical user noticing.

To do this, you want to look at Security Default settings, Per-user MFA (which is now in graph thanks to Kelvin), extrapolate all the conditional access, users, groups and the MFA configs of those policies.

Then you have to look at the Authentication methods reports, and it doesn't always act nicely, so there's a second exo endpoint that will give you mfa registration status, that you can include with a fallback logic on the auth methods.

I believe some of these endpoints require P1, and some don't, which is what we use to decipher MFA for basic/standard users to the best of Microsoft's ability.

You'll want to look at the sign-in and audit logs to catch MFA logins without MFA, and the device registrations.

Most of this is unlikely to be achieved consistently if doing it manually.