When enabling MFA, the keys for each user are stored in the default database for the given group. To help streamline access for districts, an option is needed to propagate those keys to the other default databases within the other groups. Preferably

Another option would be to instead allow all database groups to get their security exclusively from the Default Database Group while allowing an exception for a sandbox or training group (maybe via an XML config item or a DPT value).