IMO, the device should require MFA to be configured before working, using it without one should be left at most as an “advanced setting”.