if you use apple.com/icloud.com it will force user to use mfa every 1 hour. Apple got horrible engineering.