Yes. We can mix all of these features, like checking the risk of the user + checking the risk of the session + forcing the MFA challenge, and then when passed, granting access to the system, application or even document.