To answer your question, YES, "strange logins" (from new places, on new hardware) should trigger a Login Challenge, and there is a button on the user card in admin console to disable it for 10 minutes. If the account has proper 2FA, then the Login Challenge is almost always a proper 2FA request.
--
https://wheretofind.me/@NoSubstitute