Originally Posted by
nyalancat
They do prompt for MFA on certain logins, though I've not identified any rhyme or reason for when it's required
Funny story: I am sitting in a customer office in LIT. CEO is there on the trip with me. CEO says try to see if we can change our flights home. I try to login to my account, no can do. MFA block. I try to login to CEO's account from my same laptop where I was just blocked by MFA and access to boss's account works just fine.
Even with good implementation, MFA is more of a frustrating hassle than a solution. And AA's implementation is anything but good.