Enable MFA first, then review existing sessions and recovery paths.
