I would like all of my users to use two-factor authentication. However, I want them to be able to save devices. Per this article (and personal experience), it does not let you save devices if you enforce the policy at the account-holder level. I would be satisfied with periodically checking the status of two-factor on my users' accounts. However I have not found a way to audit this. Is it possible?
We enforce this at the 'user group' level and place the users into the relevant group, ensuring 2FA is required for all groups.
Thanks for the input. Does that allow people to save trusted devices? Or is that still disabled as it is when set at the account-holder level? (Referring to this article, if you didn't see it above.)