I should be able to force a password change and enable MFA for all users across my firm. Leaving up to a user to be able to turn off or on is problematic.