Enforcing the use of MFA devices