A common technique during a data breach is to use stolen credentials to find areas where an attacker can elevate their privilege. This is done to exfiltrate and steal valuable data, such as sensitive financial, customer, or employee information.
This policy helps avoid the exfiltration of data and unauthorized access to Production resources by requiring an MFA before establishing a session to those resources.