I want the option where 2FA can be configured only for local (non-SSO) users. Non-SSO users have an additional level of risk with their account, so this improves security.