You can do a review of your roles to see which ones have mandatory 2FA as well