AADSTS530035 security defaults blocks all access for an MSA-backed tenant - what is the MFA registration path?

My personal Microsoft account signs in successfully, but every Azure and Entra access is denied:

Error code: 530035 (Access has been blocked by security defaults)

App: Azure Portal (c44b4083-3bb0-49c1-b47d-974e53cbdf3c)

Tenant: 88e09d05-a7d7-41f1-8149-c0e2cb2d0998

Subscription: 317a6975-28f4-4def-a695-0c9131339077 (Azure for Students)

Client: both Azure portal and az CLI

I am the only user and the global admin of this tenant. The account is a personal Microsoft account, so the tenant is MSA-backed.

What I already tried:

1. Added Microsoft Authenticator to my Microsoft account.
2. aka.ms/mfasetup - it rejects personal accounts and asks for a work or school account.
3. Tried the tenant UPN form of my username - that user does not exist.

Because of this I cannot manage my VM, my budgets or the subscription at all, and the portal cannot open a support request either.

Question: for an MSA-backed tenant with security defaults turned on, what is the supported way to satisfy the MFA requirement? Is there a registration endpoint that works for a personal account, or can security defaults be turned off for this tenant some other way?

Thanks.