In this configuration, a user without a paired MFA device can still authenticate with their credentials.