Hi Michael,
I'm running into the same issue. I've tried to put the tenant's Customer ID into the hpe_ccs_attribute as the scope for my Aruba Central application, but that didn't work. I did immediately drop into the correct Aruba Central Tenant, but I could return to the MSP view and from there edit any other Aruba Central Tenant. Not ideal.
The 2FA question is easier: log in with and administrator account into HPE Greenlake, go to the Manage tab, click on Account Details and then on Security. There you can switch 2FA on.

Steven
------------------------------
Steven Demets
------------------------------