I have separate policies made for domain admins and everyone else. I want to require endpoint MFA logins only for domain admins on any machine with the agent installed. Is this possible? My tests seem to indicate that it's all users or nothing.