Duo is requiring a global policy for authenticating to the self service portal (used for new user enrollment and managing 2fa devices) and will impose their recommended policy unless we add one. The global policy being added should provide the least impact possible.