Comment by frameset

To defend Redmond here, Entra is an enterprise system. If the company you work for or are interfacing with wants to enforce attestation, that's their business.

B2C I would expect more latitude on requiring attestation.