MFA is required in policy and one bastion path still bypasses it

A bastion hardening change is rolled out and later one login path authenticates users without the expected MFA challenge.