[MaxGabriel]

If your app is team based, you could set it up so that admins of the team can reset people’s 2FA device, similar to how AWS does it with IAM roles.

[eropple]

If their app is team based, they should be deferring 2FA to the IdP that that team should already have.