The Users page

Every action here is step-up-gated (re-verify with your current password, or a passkey prompt at the moment you click) and audit-logged. Reset MFA additionally requires ticking "Identity verified out-of-band" — a hard requirement, not just a warning, since clearing someone's MFA is a common social-engineering target.

The app always keeps at least one active super admin — an action that would leave zero is refused rather than silently allowed.