Status: IN
Cancelling MFA assignment midway creates an orphaned virtual MFA device that blocks future assignment — it must be deleted via `aws iam delete-virtual-mfa-device`, not by editing policies.
Source: entries/2026/03/11/IAM-latest-UserGuide-troubleshoothtml.md