If you think there's a bug, then you can file one and it will be looked at. It's not impossible one exists, and most deployments rely on the MFA flow now so the original logic is not heavily used anymore. It should be walking the entire list before making a final determination, and as far as I know it does. -- Scott