Create new MFA setting to default new admins with MFA enabled
MFA - Add MFA behavior of "All admins require MFA with exceptions". Instead of having to manually add MFA to an admin after the user has been created. Default it to the user requiring MFA unless otherwise specified. That way if an admin is created a second step is no longer required to enable MFA when the user is provisioned. Reducing risk, as well as allowing the AD Sync utility to continue to work.