Audit Multi Factor Settings

[lightsong57]

I would like all of my users to use two-factor authentication. However, I want them to be able to save devices. Per this article (and personal experience), it does not let you save devices if you enforce the policy at the account-holder level. I would be satisfied with periodically checking the status of two-factor on my users' accounts. However I have not found a way to audit this. Is it possible?

[HappyHippo]

We enforce this at the 'user group' level and place the users into the relevant group, ensuring 2FA is required for all groups.

[lightsong57]

Thanks for the input. Does that allow people to save trusted devices? Or is that still disabled as it is when set at the account-holder level? (Referring to this article, if you didn't see it above.)