Auth - Azure SSO SCIM: Once users enable 2FA the unchangeable state of the user account gets removed

### Environment

SaaS (https://sentry.io/)

### Steps to Reproduce

1. Enable SSO + SCIM
2. Provision the user from SCIM
3. User enables 2FA

This makes it possible again that the org owner or own user can remove the user account which should not be possible

### Expected Result

We would like to enforce 2FA, but can't at the moment as this will likely result in some unwanted behaviour in user management. It is possible to reconnect the user to Sentry, but they will end up without any Team. A Group Sync from AzureAD/EntraID, or removing and adding a user back to the group does not seem to fix this

### Actual Result

enabling 2FA removes this restriction from SCIM

### Product Area

Settings - Auth

### Link

_No response_

### DSN

_No response_

### Version

_No response_

┆Issue is synchronized with this [Jira Improvement](https://getsentry.atlassian.net/browse/FEEDBACK-2295) by [Unito](https://www.unito.io)