Conditional restriction

We want all website admins to have 2FA enabled. However, we are using an SSO plugin that allows Azure group members to log in to the website.

Some users fall into both categories: they are admins and also use SSO. For these users, we don’t want or need to enforce 2FA.

Is there a way to create a condition to handle this? Users logging in via SSO are assigned a specific user role.

I initially thought that enabling “ENFORCE 2FA” for Admins and excluding the SSO user role would work, but it doesn’t seem to function as expected.

My concern is scalability—if we want to enforce 2FA for additional user roles beyond admins, adding exceptions for each user individually isn’t practical. Do you have any suggestions for managing this setup effectively?