How are 2FA enabled/disable events tracked?

Knowledge Drop

Last tested: Jul 13, 2019

You can look for
update_totp_config in the logs and in the System Activity events explore