Do we need a password manager if we already have multi-factor authentication?

Multi factor authentication protects the accounts that support it, which is mostly your email, your Microsoft or Google tenant, and better modern services. That is genuinely the single most valuable control you can have, and it is not the whole picture.

What it does not cover:

• The accounts with no multi-factor option at all. Vendor portals, older line of business systems, utility accounts, some banking, state and licensing sites. Passwords are the only protection those have.
• Reused passwords. If one password is used in several places and appears in a breach of any of them, every account using it is exposed. A password manager is what makes unique passwords practical, because nobody remembers forty of them.
• Knowing who has what. Multi factor says nothing about which staff can reach which systems.
• Handover. When someone leaves or is unreachable, the manager is where the business finds what it owns.

Use both. Multi factor is the more important of the two and a password manager is what covers everything multi factor cannot reach.