MFA Disabled and MFA Enforced don't mean the user is prompted for MFA every time tries to access something. MFA Enforced means the user has completed the enrollment.

  MFA Disabled and MFA Enforced don't mean the user is prompted for MFA every time tries to access something. MFA Enforced means the user has completed the enrollment.

The trusted IPs feature of Azure AD Multi-Factor Authentication bypasses multi-factor authentication prompts for users who sign in from a defined IP address range. You can set trusted IP ranges for your on-premises environments. When users are in one of these locations, there's no Azure AD Multi-Factor Authentication prompt. The trusted IPs feature requires Azure AD Premium P1 edition.