Beyond admins, researchers say that 97 percent of all total Microsoft 365 users do not use multi-factor authentication.