Unenroll removes a MFA factor. A user has to have an aal2 authenticator level in order to unenroll a verified factor.
aal2
verified