Reference:
New Microsoft 365/Azure AD tenants enable Security defaults by default. The SC-300 materials emphasize that Security defaults and Conditional Access cannot be used together; to create and enforce custom Conditional Access policies (for example, requiring MFA under specific conditions), you must turn off Security defaults first. After disabling Security defaults, you can define Conditional Access policies that target specific users, apps, locations, or device states, and require controls such as MFA or session restrictions.
Disabling user consent, configuring on-premises password protection, or merely creating an MFA registration policy do not enable Conditional Access; they address different capabilities. Therefore, the first step to control access with Conditional Access is to disable Security defaults.