Option A: Enforcing MFA through conditional access policies ensures that privileged accounts remain secure without disrupting legitimate operations. This approach addresses the identified risk directly and aligns with best practices.
Option B: Changing passwords can enhance security but does not address the lack of MFA, leaving the accounts still vulnerable to unauthorized access. This action alone is not comprehensive.
Option C: While revoking privileges could mitigate risks, it is often too disruptive and impractical for operational accounts or critical users. Instead, enforcing MFA is a more balanced and effective solution.
Option D: Permanent account disabling is unnecessary and counterproductive unless there is clear evidence of a security breach. This approach does not address the root cause of missing MFA.