Not to mention the fact that you can force single-factor authentication using Skype for business despite requiring MFA across the board. Just had to patch that hole recently.