New tenant has P2, secure score of 91+, but no MS managed CA policies?

I had to build a new tenant in a hurry two weeks ago. It has 3 licenses, (BP + Defender Suite/Purview for BP), so it is P2. The Entra screen says P2 tenant in portal.azure.com. Secure Score is 91+. There are no CA policies yet as I have many things on my plate. In my main tenant, I have MFA and phish-resistant MFA ones pushed from Microsoft. I do not have the MS managed CA rules like I expected in the new tenant. I even had duplicates of the MS managed ones in my main tenant. There are no CA rules at all.

Secure score is showing all these as completed

• Enable Microsoft Entra ID Identity Protection user risk policies
• Enable Microsoft Entra ID Identity Protection sign-in risk policies
• Enable Conditional Access policies to block legacy authentication
• Ensure multifactor authentication is enabled for all users in administrative roles
• Ensure multifactor authentication is enabled for all users

but silly me expects these to be Conditional Access rules like in my main tenant. I am GA for my secondary account.

I am confused as to how and where these are set. Has anyone seen this?

thx