
The other checks verifying configuration and organization parameters pass okay except Check LegacyAuthProtocols:

I've run Get-SpoTenant and that reports this is enabled:

Some tenant level changes have been made recently: password expiry was enabled and MFA was turned on - but not for the global admin account been used for VOB. And the password works fine as the other checks would fail. The service account is a global administrator.
Any ideas?