(1) Reference authority. This one is a bandaid, but it gets you out of the debate a lot. "This is required by the insurance" "The management team is enforcing this". Best for users who really won't be happy with any answer. It's out of my hands, it's required. I'm just a messenger.

(2) Reference legal/risk management/bureaucracy. Kind of like authority, but gives a view of the bigger picture. "We have to be even across all users, and this is the best method we have to prevent X-risk.". "The inconvenience of not implementing this can far outweigh the risk of implementing Y." Best for users who are frustrated and just need reassurance that you aren't just throwing things out without reason

(3) Solutions focused. Look got ways to make their lives easier with the new policy. For example, if the new policy is absolutely no writing down passwords in Excel/word/notepad because they found out everyone was using those, show them 1password/bitWarden/etc. If they are hating MFA, show how it's an occasional inconvenience, but once you validated the computer it will rarely ask for it. Even the most annoying systems have ways to lessen the pain. Even anecdotal empathizing "Yes, I hated the MFA at the start, but now it is no more annoying than entering my password. We all have our phones on us all the time now anyways."

(4) Fully explain the situation. Usually this is more time-consuming than you have, but show benefits and technical reasons. Show it's the best policy to have and why you agree with it. (Or at least, why you should agree with it) They still might disagree, but at least you stop being a target for being the bad guy enforcer if you can convince them that you are helping them. Not effective for ones that you pointedly disagree with.