With DualShield you can exempt MFA by users, user groups, or user domains. Commonly, customers set up MFA exemption by user group, as it is more flexible.