You might see that the Dropbox Community team have been busy working on some major updates to the Community itself! So, here is some info on what’s changed, what’s staying the same and what you can expect from the Dropbox Community overall.
Forum Discussion
MFA can be switched off in fact
If you will set up MFA required for all, users will set up their phone numbers as second stage of login - for code via sms.
During login with MFA, users on screen for code from sms, can mark checkbox 'trust this machine' (or similar meaning).
From that time user will be not asked anymore about sms code - that wrong because it's against of admin settings for MFA. User CAN switch it off in fact.
User can do that on some computer which is not owning to him etc. .
From Security perspective it should be corrected immediately - minimum: "trusting" checkbox on screen for sms code, should NOT be displayed with MFA marked by admin as mandatory. Try to imagine that first user will save password and login on such computer and later turn on (mark) "trust this machine" and boom-> big problems.
