Do all of our important accounts actually have multi-factor authentication turned on?

Create a list of critical systems and verify MFA from the administration side instead of relying on user memory. Prioritize email, financial systems, cloud administration, CRM, remote access, and privileged accounts, then track exceptions until they are resolved.