Changes to MFA in Enterprise
Current MFA controls work like this:
If global mfa is set to off, and granular mfa is set to off, but user already has mfa configured, mfa remains on.
I suggest that if global mfa and granular mfa are set to off then that should override any setting the user has. This is an enterprise environment. I should have final say.