MFA is required by default. Administrators can configure an audited per-account development exception.