SSO users get error when trying to register an MFA device "It's not you, it's us"

Hi All,

All of my users are getting an error when trying to set up an Authenticator app in their MFA settings via the user portal. The users are brought to the Register MFA device screen and can choose a type and hit next, but then are presented with an error stating "It's not you, it's us. We couldn't complete your request right now. Please try again later."

Current settings:

• Users should be prompted for MFA: always-on
• Users can authenticate with these MFA types: Authenticator apps
• If a user does not yet have a registered MFA device: Require them to register MFA device at sign in
• Who can manage MFA devices: Users can add and manage their own MFS devices
• Identity Source: AWS SSO

I have tried various other configurations with the same results. I can assign MFA devices to users from the SSO console as an administrator. Are there other settings I'm missing?

Thank you