How is it determined whether a user is partially enrolled versus fully enrolled in ADSelfservice Plus? I was told before that it has something to do with the number or enrolled MFA auth app compared to the offered configured MFA auth apps. Is there any documentation on this?