templates for creating a full privilege group and a read only group, as well as a script for moving non-mfa'd users from the privileged group to the read only group - View it on GitHub