Changes to MFA in Enterprise

Current MFA controls work like this:

If global mfa is set to off, and granular mfa is set to off, but user already has mfa configured, mfa remains on.

I suggest that if global mfa and granular mfa are set to off then that should override any setting the user has. This is an enterprise environment. I should have final say.