diff --git a/resources/celerity/map.php b/resources/celerity/map.php
--- a/resources/celerity/map.php
+++ b/resources/celerity/map.php
@@ -9,7 +9,7 @@
   'names' => array(
     'conpherence.pkg.css' => '3c8a0668',
     'conpherence.pkg.js' => '020aebcf',
-    'core.pkg.css' => 'e94cc920',
+    'core.pkg.css' => 'a66ea2e7',
     'core.pkg.js' => '5c737607',
     'differential.pkg.css' => 'b8df73d4',
     'differential.pkg.js' => '67c9ea4c',
@@ -127,7 +127,7 @@
     'rsrc/css/phui/calendar/phui-calendar-list.css' => 'ccd7e4e2',
     'rsrc/css/phui/calendar/phui-calendar-month.css' => 'cb758c42',
     'rsrc/css/phui/calendar/phui-calendar.css' => 'f11073aa',
-    'rsrc/css/phui/object-item/phui-oi-big-ui.css' => 'e5b1fb04',
+    'rsrc/css/phui/object-item/phui-oi-big-ui.css' => '9e037c7a',
     'rsrc/css/phui/object-item/phui-oi-color.css' => 'b517bfa0',
     'rsrc/css/phui/object-item/phui-oi-drag-ui.css' => 'da15d3dc',
     'rsrc/css/phui/object-item/phui-oi-flush-ui.css' => '490e2e2e',
@@ -832,7 +832,7 @@
     'phui-lightbox-css' => '4ebf22da',
     'phui-list-view-css' => '470b1adb',
     'phui-object-box-css' => '9b58483d',
-    'phui-oi-big-ui-css' => 'e5b1fb04',
+    'phui-oi-big-ui-css' => '9e037c7a',
     'phui-oi-color-css' => 'b517bfa0',
     'phui-oi-drag-ui-css' => 'da15d3dc',
     'phui-oi-flush-ui-css' => '490e2e2e',
@@ -1710,6 +1710,9 @@
       'javelin-uri',
       'phabricator-textareautils',
     ),
+    '9e037c7a' => array(
+      'phui-oi-list-view-css',
+    ),
     '9f081f05' => array(
       'javelin-behavior',
       'javelin-dom',
@@ -2024,9 +2027,6 @@
     'e562708c' => array(
       'javelin-install',
     ),
-    'e5b1fb04' => array(
-      'phui-oi-list-view-css',
-    ),
     'e5bdb730' => array(
       'javelin-behavior',
       'javelin-stratcom',
diff --git a/src/applications/auth/controller/mfa/PhabricatorAuthFactorProviderEditController.php b/src/applications/auth/controller/mfa/PhabricatorAuthFactorProviderEditController.php
--- a/src/applications/auth/controller/mfa/PhabricatorAuthFactorProviderEditController.php
+++ b/src/applications/auth/controller/mfa/PhabricatorAuthFactorProviderEditController.php
@@ -41,18 +41,33 @@
       ->setBig(true)
       ->setFlush(true);
 
+    $factors = msortv($factors, 'newSortVector');
+
     foreach ($factors as $factor_key => $factor) {
       $factor_uri = id(new PhutilURI('/mfa/edit/'))
         ->setQueryParam('providerFactorKey', $factor_key);
       $factor_uri = $this->getApplicationURI($factor_uri);
 
+      $is_enabled = $factor->canCreateNewProvider();
+
       $item = id(new PHUIObjectItemView())
         ->setHeader($factor->getFactorName())
-        ->setHref($factor_uri)
-        ->setClickable(true)
         ->setImageIcon($factor->newIconView())
         ->addAttribute($factor->getFactorCreateHelp());
 
+      if ($is_enabled) {
+        $item
+          ->setHref($factor_uri)
+          ->setClickable(true);
+      } else {
+        $item->setDisabled(true);
+      }
+
+      $create_description = $factor->getProviderCreateDescription();
+      if ($create_description) {
+        $item->appendChild($create_description);
+      }
+
       $menu->addItem($item);
     }
 
diff --git a/src/applications/auth/factor/PhabricatorAuthFactor.php b/src/applications/auth/factor/PhabricatorAuthFactor.php
--- a/src/applications/auth/factor/PhabricatorAuthFactor.php
+++ b/src/applications/auth/factor/PhabricatorAuthFactor.php
@@ -45,6 +45,33 @@
       ->setIcon('fa-mobile');
   }
 
+  public function canCreateNewProvider() {
+    return true;
+  }
+
+  public function getProviderCreateDescription() {
+    return null;
+  }
+
+  public function canCreateNewConfiguration(PhabricatorUser $user) {
+    return true;
+  }
+
+  public function getConfigurationCreateDescription(PhabricatorUser $user) {
+    return null;
+  }
+
+  public function getFactorOrder() {
+    return 1000;
+  }
+
+  final public function newSortVector() {
+    return id(new PhutilSortVector())
+      ->addInt($this->canCreateNewProvider() ? 0 : 1)
+      ->addInt($this->getFactorOrder())
+      ->addString($this->getFactorName());
+  }
+
   protected function newChallenge(
     PhabricatorAuthFactorConfig $config,
     PhabricatorUser $viewer) {
diff --git a/src/applications/auth/storage/PhabricatorAuthFactorProvider.php b/src/applications/auth/storage/PhabricatorAuthFactorProvider.php
--- a/src/applications/auth/storage/PhabricatorAuthFactorProvider.php
+++ b/src/applications/auth/storage/PhabricatorAuthFactorProvider.php
@@ -101,6 +101,14 @@
     return $config;
   }
 
+  public function newSortVector() {
+    $factor = $this->getFactor();
+
+    return id(new PhutilSortVector())
+      ->addInt($factor->getFactorOrder())
+      ->addInt($this->getID());
+  }
+
 
 /* -(  PhabricatorApplicationTransactionInterface  )------------------------- */
 
diff --git a/src/applications/settings/panel/PhabricatorMultiFactorSettingsPanel.php b/src/applications/settings/panel/PhabricatorMultiFactorSettingsPanel.php
--- a/src/applications/settings/panel/PhabricatorMultiFactorSettingsPanel.php
+++ b/src/applications/settings/panel/PhabricatorMultiFactorSettingsPanel.php
@@ -169,6 +169,7 @@
         ->addCancelButton($cancel_uri);
     }
     $providers = mpull($providers, null, 'getPHID');
+    $proivders = msortv($providers, 'newSortVector');
 
     $token = id(new PhabricatorAuthSessionEngine())->requireHighSecuritySession(
       $viewer,
@@ -180,6 +181,13 @@
       $selected_provider = null;
     } else {
       $selected_provider = $providers[$selected_phid];
+
+      // Only let the user continue creating a factor for a given provider if
+      // they actually pass the provider's checks.
+      $selected_factor = $selected_provider->getFactor();
+      if (!$selected_factor->canCreateNewConfiguration($viewer)) {
+        $selected_provider = null;
+      }
     }
 
     if (!$selected_provider) {
@@ -192,13 +200,28 @@
         $provider_uri = id(new PhutilURI($this->getPanelURI()))
           ->setQueryParam('providerPHID', $provider_phid);
 
+        $factor = $provider->getFactor();
+        $is_enabled = $factor->canCreateNewConfiguration($viewer);
+
         $item = id(new PHUIObjectItemView())
           ->setHeader($provider->getDisplayName())
-          ->setHref($provider_uri)
-          ->setClickable(true)
           ->setImageIcon($provider->newIconView())
           ->addAttribute($provider->getDisplayDescription());
 
+        if ($is_enabled) {
+          $item
+            ->setHref($provider_uri)
+            ->setClickable(true);
+        } else {
+          $item->setDisabled(true);
+        }
+
+        $create_description = $factor->getConfigurationCreateDescription(
+          $viewer);
+        if ($create_description) {
+          $item->appendChild($create_description);
+        }
+
         $menu->addItem($item);
       }
 
diff --git a/webroot/rsrc/css/phui/object-item/phui-oi-big-ui.css b/webroot/rsrc/css/phui/object-item/phui-oi-big-ui.css
--- a/webroot/rsrc/css/phui/object-item/phui-oi-big-ui.css
+++ b/webroot/rsrc/css/phui/object-item/phui-oi-big-ui.css
@@ -72,3 +72,8 @@
 .device-desktop .phui-oi-linked-container a:hover {
   text-decoration: none;
 }
+
+/* Spacing for InfoView inside an object item list, like MFA setup. */
+.phui-oi .phui-info-view {
+  margin: 0 4px 4px;
+}