It would be good if there was an option to enforce any 2FA option for a organisation.
If ticked, when a user logs in they have to enable any of the available options. Currently the only option is DUO. However, under each account you can already pick from multiple (authenticator app, email etc).