Multi-Factor Authentication settings, Inactive Mailboxes, Conditional Access Policies and Application Proxy settings are not backed up by default as it is required to configure the Tenant Admin Credentials to backup these settings.
In addition, if On Demand Recovery is not configured to backup these additional settings it will not be possible to restore those settings.
Once configured, On Demand Recovery will backup the following additional items:
To configure On Demand Recovery to backup the MFA settings:
NOTE: The account you specify either has to have MFA disabled or you have to add the On Demand Recovery IP Address to the list of Trusted IPs for your Azure tenant. On Demand Recovery uses IP Address prefixes for the IP address range used in each region. For the list of regional prefixes that you would need to add to the Trusted IPs for your tenant, please see the bottom of the "Backup and Restore of MFA Settings" section of the User Guide:
The following Microsoft article discusses how to configure the bypass for MFA using Trusted IPs: