Hi Medplum team. We are using Medplum Cloud and we are considering to use Medplum native TOTP as the default MFA. We can enforce MFA by requiring MFA in the user invitation. But can the invited user possible self-opt out of MFA once required to use MFA via invitation? Can admin user remove this MFA requirement for the user? I couldn't find any documentation on this and I did some test and it seems like there is no self-opt out option for MFA required by invite (which is different from self-enrolled MFA) Please confirm the expected behavior. Thank you.

Hey Yong!

mfaRequired

lives on the User record and can only be enabled/disabled by admin users. It is not possible for non-admin users to edit

User.mfaRequired

, regardless of whether or not it was set upon invite.

Thank you for the response that answers my question!