We just recently purchased a few licenses of the FedRAMP version of box.  I am the admin and I setup some items to be applied to all like 2FA.  However, users are able to setup their account with out it even though it is set to all.  Also, I deselected allow users to create their own accounts yet it allowed someone who received a link.