The pool requires TOTP, so it can be replaced but never turned off.
The IdP owns the password and second factor; only the passkeys are the login's own.
The pool requires TOTP, so it can be replaced but never turned off.