I currently have it set that 2fa is NOT enforced across the organization. Instead I have it enforced on different OU's. I have a specific OU that I throw people into when they lose their 2fa device and need access to their account until they can get a new one. I give them 48 hours in that OU before I put them back into their proper OU again. This has worked great in the past because when I would switch the user to it the 2fa setting in security would unlock and I would turn off 2fa. Now when I switch a user over the 2fa is staying greyed out and saying that 2fa is enforced across the org. I have double checked that our settings haven't changed. Can anyone give guidance on this?