Required on this site
In Account Settings, when authenticator is on but the member cannot disable it, the UI shows Required on this site instead of Turn off (canDisableTwoFactor false).
Why this happens
Two-factor authentication mode is mandatory. Members must keep 2FA enabled; only staff reset can clear it. Status label — not an API error.
Diagnose and fix
1. Admin: switch mode from mandatory to optional if members should be allowed to turn 2FA off.
2. Members: keep using the authenticator app at login; lost device → ask staff to Reset user 2FA / sessions.
3. Distinct from Disabled by administrator (TOTP not allowed at all).