Requiring MFA to deactivate MFA

[umarbutler]

Hi,
What is the best way to require MFA for someone to deactivate MFA? Right now, using default settings, to deactivate MFA, a user only needs to reauthenticate with their password, however, I would like to require MFA instead.

In fact, I would prefer to require MFA for everywhere the normal password reauthentication form would be used, if possible.

I'm struggling to figure out what the best way to achieve this.