Depends on D20037. Ref T13222. Ref T7667. Although administrators can now disable MFA from the web UI, at least require that they survive MFA gates to do so. T7667 (bin/auth lock) should provide a sturdier approach here in the long term.

Created and edited MFA providers, was prompted for MFA.