Risk-management pattern from the Prevent Account Sharing talk: instead of turning MFA on for every user — which risks churn because users dislike extra friction — identify users who violate a rule (e.g. more than N concurrent login sessions) via a SQL query and enable MFA only for them, on a periodic cadence (e.g. weekly).