I've seen some companies (Cloudflare springs to mind) which requires a support ticket to disable MFA on a user's account. It's a little tedious but does add an

I've seen some companies (Cloudflare springs to mind) which requires a support ticket to disable MFA on a user's account. It's a little tedious but does add an extra hoop for an attacker to jump through.