Settings
Administrators always require MFA
This is a platform floor, not a per-organisation setting - every account with an admin or platform-operator role must use a second factor. There is no control anywhere in this application that can turn it off, for any role that carries admin access, for any organisation.
For non-admin roles
This is the one part of the MFA policy that is actually a choice - whether a standard user is asked for a second factor at all.