diff --git a/admin/tool/mfa/classes/plugininfo/factor.php b/admin/tool/mfa/classes/plugininfo/factor.php
index ce4118d5208..b1344027176 100644
--- a/admin/tool/mfa/classes/plugininfo/factor.php
+++ b/admin/tool/mfa/classes/plugininfo/factor.php
@@ -256,6 +256,10 @@ class factor extends \core\plugininfo\base {
      * @param bool $hassiteconfig whether the current user has moodle/site:config capability
      */
     public function load_settings(\part_of_admin_tree $adminroot, $parentnodename, $hassiteconfig): void {
+        global $CFG, $USER, $DB, $OUTPUT, $PAGE; // In case settings.php wants to refer to them.
+        /** @var \admin_root $ADMIN */
+        $ADMIN = $adminroot; // May be used in settings.php.
+        $plugininfo = $this; // Also can be used inside settings.php.
 
         if (!$this->is_installed_and_upgraded()) {
             return;
@@ -269,9 +273,7 @@ class factor extends \core\plugininfo\base {
 
         $settings = new \admin_settingpage($section, $this->displayname, 'moodle/site:config', $this->is_enabled() === false);
 
-        if ($adminroot->fulltree) {
-            include($this->full_path('settings.php'));
-        }
+        include($this->full_path('settings.php'));
 
         $adminroot->add($parentnodename, $settings);
     }
diff --git a/admin/tool/mfa/factor/admin/settings.php b/admin/tool/mfa/factor/admin/settings.php
index 2520cd7baa7..9135db27b67 100644
--- a/admin/tool/mfa/factor/admin/settings.php
+++ b/admin/tool/mfa/factor/admin/settings.php
@@ -25,14 +25,16 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_admin/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('admin', get_config('factor_admin', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_admin/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('admin', get_config('factor_admin', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_admin/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'factor_admin'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_admin/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'factor_admin'), 100, PARAM_INT));
+}
diff --git a/admin/tool/mfa/factor/auth/settings.php b/admin/tool/mfa/factor/auth/settings.php
index c61009cba58..23a5126879b 100644
--- a/admin/tool/mfa/factor/auth/settings.php
+++ b/admin/tool/mfa/factor/auth/settings.php
@@ -25,25 +25,27 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_auth/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('auth', get_config('factor_auth', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_auth/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('auth', get_config('factor_auth', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_auth/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_auth/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$authtypes = get_enabled_auth_plugins(true);
-$authselect = [];
-foreach ($authtypes as $type) {
-    $auth = get_auth_plugin($type);
-    $authselect[$type] = $auth->get_title();
+    $authtypes = get_enabled_auth_plugins(true);
+    $authselect = [];
+    foreach ($authtypes as $type) {
+        $auth = get_auth_plugin($type);
+        $authselect[$type] = $auth->get_title();
+    }
+
+    $settings->add(new admin_setting_configmulticheckbox('factor_auth/goodauth',
+        get_string('settings:goodauth', 'factor_auth'),
+        get_string('settings:goodauth_help', 'factor_auth'), [], $authselect));
 }
-
-$settings->add(new admin_setting_configmulticheckbox('factor_auth/goodauth',
-    get_string('settings:goodauth', 'factor_auth'),
-    get_string('settings:goodauth_help', 'factor_auth'), [], $authselect));
diff --git a/admin/tool/mfa/factor/capability/settings.php b/admin/tool/mfa/factor/capability/settings.php
index d5d1be595e2..d662880dd7c 100644
--- a/admin/tool/mfa/factor/capability/settings.php
+++ b/admin/tool/mfa/factor/capability/settings.php
@@ -25,19 +25,21 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_capability/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('capability', get_config('factor_capability', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_capability/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('capability', get_config('factor_capability', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_capability/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_capability/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-// Admin passes bool logic is inverted due to negative capability check.
-$settings->add(new admin_setting_configcheckbox('factor_capability/adminpasses',
-    new lang_string('settings:adminpasses', 'factor_capability'),
-    new lang_string('settings:adminpasses_help', 'factor_capability'), 1, 0, 1));
+    // Admin passes bool logic is inverted due to negative capability check.
+    $settings->add(new admin_setting_configcheckbox('factor_capability/adminpasses',
+        new lang_string('settings:adminpasses', 'factor_capability'),
+        new lang_string('settings:adminpasses_help', 'factor_capability'), 1, 0, 1));
+}
diff --git a/admin/tool/mfa/factor/cohort/settings.php b/admin/tool/mfa/factor/cohort/settings.php
index 08aede8d5ed..a2ded7b51e4 100644
--- a/admin/tool/mfa/factor/cohort/settings.php
+++ b/admin/tool/mfa/factor/cohort/settings.php
@@ -26,27 +26,29 @@
 defined('MOODLE_INTERNAL') || die();
 require_once(__DIR__ . '/../../../../../cohort/lib.php');
 
-$enabled = new admin_setting_configcheckbox('factor_cohort/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('cohort', get_config('factor_cohort', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_cohort/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('cohort', get_config('factor_cohort', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_cohort/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_cohort/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$cohorts = cohort_get_all_cohorts();
-$choices = [];
+    $cohorts = cohort_get_all_cohorts();
+    $choices = [];
 
-foreach ($cohorts['cohorts'] as $cohort) {
-    $choices[$cohort->id] = $cohort->name;
-}
+    foreach ($cohorts['cohorts'] as $cohort) {
+        $choices[$cohort->id] = $cohort->name;
+    }
 
-if (!empty($choices)) {
-    $settings->add(new admin_setting_configmultiselect('factor_cohort/cohorts',
-    new lang_string('settings:cohort', 'factor_cohort'),
-    new lang_string('settings:cohort_help', 'factor_cohort'), [], $choices));
+    if (!empty($choices)) {
+        $settings->add(new admin_setting_configmultiselect('factor_cohort/cohorts',
+        new lang_string('settings:cohort', 'factor_cohort'),
+        new lang_string('settings:cohort_help', 'factor_cohort'), [], $choices));
+    }
 }
diff --git a/admin/tool/mfa/factor/email/settings.php b/admin/tool/mfa/factor/email/settings.php
index cf44edf0c48..8ebf75d4cfb 100644
--- a/admin/tool/mfa/factor/email/settings.php
+++ b/admin/tool/mfa/factor/email/settings.php
@@ -25,22 +25,24 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_email/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('email', get_config('factor_email', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_email/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('email', get_config('factor_email', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_email/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_email/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_email/duration',
-    get_string('settings:duration', 'factor_email'),
-    get_string('settings:duration_help', 'factor_email'), 30 * MINSECS, MINSECS));
+    $settings->add(new admin_setting_configduration('factor_email/duration',
+        get_string('settings:duration', 'factor_email'),
+        get_string('settings:duration_help', 'factor_email'), 30 * MINSECS, MINSECS));
 
-$settings->add(new admin_setting_configcheckbox('factor_email/suspend',
-    get_string('settings:suspend', 'factor_email'),
-    get_string('settings:suspend_help', 'factor_email'), 0));
+    $settings->add(new admin_setting_configcheckbox('factor_email/suspend',
+        get_string('settings:suspend', 'factor_email'),
+        get_string('settings:suspend_help', 'factor_email'), 0));
+}
diff --git a/admin/tool/mfa/factor/grace/settings.php b/admin/tool/mfa/factor/grace/settings.php
index eb1448bd2fc..231c3aed312 100644
--- a/admin/tool/mfa/factor/grace/settings.php
+++ b/admin/tool/mfa/factor/grace/settings.php
@@ -25,36 +25,38 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_grace/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('grace', get_config('factor_grace', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_grace/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('grace', get_config('factor_grace', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_grace/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_grace/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configcheckbox('factor_grace/forcesetup',
-    new lang_string('settings:forcesetup', 'factor_grace'),
-    new lang_string('settings:forcesetup_help', 'factor_grace'), 0));
+    $settings->add(new admin_setting_configcheckbox('factor_grace/forcesetup',
+        new lang_string('settings:forcesetup', 'factor_grace'),
+        new lang_string('settings:forcesetup_help', 'factor_grace'), 0));
 
-$settings->add(new admin_setting_configduration('factor_grace/graceperiod',
-    new lang_string('settings:graceperiod', 'factor_grace'),
-    new lang_string('settings:graceperiod_help', 'factor_grace'), '604800'));
+    $settings->add(new admin_setting_configduration('factor_grace/graceperiod',
+        new lang_string('settings:graceperiod', 'factor_grace'),
+        new lang_string('settings:graceperiod_help', 'factor_grace'), '604800'));
 
-$gracefactor = \tool_mfa\plugininfo\factor::get_factor('grace');
-$factors = $gracefactor->get_all_affecting_factors();
-$gracefactors = [];
-foreach ($factors as $factor) {
-    $gracefactors[$factor->name] = $factor->get_display_name();
+    $gracefactor = \tool_mfa\plugininfo\factor::get_factor('grace');
+    $factors = $gracefactor->get_all_affecting_factors();
+    $gracefactors = [];
+    foreach ($factors as $factor) {
+        $gracefactors[$factor->name] = $factor->get_display_name();
+    }
+    $settings->add(new admin_setting_configmultiselect('factor_grace/ignorelist',
+        new lang_string('settings:ignorelist', 'factor_grace'),
+        new lang_string('settings:ignorelist_help', 'factor_grace'), [], $gracefactors));
+
+    $settings->add(new admin_setting_confightmleditor('factor_grace/customwarning',
+        new lang_string('settings:customwarning', 'factor_grace'),
+        new lang_string('settings:customwarning_help', 'factor_grace'), '', PARAM_RAW));
 }
-$settings->add(new admin_setting_configmultiselect('factor_grace/ignorelist',
-    new lang_string('settings:ignorelist', 'factor_grace'),
-    new lang_string('settings:ignorelist_help', 'factor_grace'), [], $gracefactors));
-
-$settings->add(new admin_setting_confightmleditor('factor_grace/customwarning',
-    new lang_string('settings:customwarning', 'factor_grace'),
-    new lang_string('settings:customwarning_help', 'factor_grace'), '', PARAM_RAW));
diff --git a/admin/tool/mfa/factor/iprange/settings.php b/admin/tool/mfa/factor/iprange/settings.php
index 463503a111a..f75d4df6d7f 100644
--- a/admin/tool/mfa/factor/iprange/settings.php
+++ b/admin/tool/mfa/factor/iprange/settings.php
@@ -27,35 +27,36 @@ defined('MOODLE_INTERNAL') || die();
 
 global $OUTPUT;
 
-$enabled = new admin_setting_configcheckbox('factor_iprange/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('iprange', get_config('factor_iprange', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_iprange/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('iprange', get_config('factor_iprange', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_iprange/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_iprange/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
 
-// Current IP validation against list for description.
-$allowedips = get_config('factor_iprange', 'safeips');
-if (trim($allowedips) == '') {
-    $message = 'allowedipsempty';
-    $type = 'notifyerror';
-} else if (remoteip_in_list($allowedips)) {
-    $message = 'allowedipshasmyip';
-    $type = 'notifysuccess';
-} else {
-    $message = 'allowedipshasntmyip';
-    $type = 'notifyerror';
-};
-$info = $OUTPUT->notification(get_string($message, 'factor_iprange', ['ip' => getremoteaddr()]), $type);
-
-$settings->add(new admin_setting_configiplist('factor_iprange/safeips',
-    new lang_string('settings:safeips', 'factor_iprange'),
-    new lang_string('settings:safeips_help', 'factor_iprange',
-            ['info' => $info, 'syntax' => get_string('ipblockersyntax', 'admin')]), '', PARAM_TEXT));
+    // Current IP validation against list for description.
+    $allowedips = get_config('factor_iprange', 'safeips');
+    if (trim($allowedips) == '') {
+        $message = 'allowedipsempty';
+        $type = 'notifyerror';
+    } else if (remoteip_in_list($allowedips)) {
+        $message = 'allowedipshasmyip';
+        $type = 'notifysuccess';
+    } else {
+        $message = 'allowedipshasntmyip';
+        $type = 'notifyerror';
+    };
+    $info = $OUTPUT->notification(get_string($message, 'factor_iprange', ['ip' => getremoteaddr()]), $type);
 
+    $settings->add(new admin_setting_configiplist('factor_iprange/safeips',
+        new lang_string('settings:safeips', 'factor_iprange'),
+        new lang_string('settings:safeips_help', 'factor_iprange',
+                ['info' => $info, 'syntax' => get_string('ipblockersyntax', 'admin')]), '', PARAM_TEXT));
+}
diff --git a/admin/tool/mfa/factor/nosetup/settings.php b/admin/tool/mfa/factor/nosetup/settings.php
index 679d2e8b160..2742b6537c4 100644
--- a/admin/tool/mfa/factor/nosetup/settings.php
+++ b/admin/tool/mfa/factor/nosetup/settings.php
@@ -25,14 +25,16 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_nosetup/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('nosetup', get_config('factor_nosetup', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_nosetup/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('nosetup', get_config('factor_nosetup', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_nosetup/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_nosetup/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+}
diff --git a/admin/tool/mfa/factor/role/settings.php b/admin/tool/mfa/factor/role/settings.php
index 4645638c348..9e62f9a9da7 100644
--- a/admin/tool/mfa/factor/role/settings.php
+++ b/admin/tool/mfa/factor/role/settings.php
@@ -25,24 +25,26 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_role/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('role', get_config('factor_role', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_role/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('role', get_config('factor_role', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_role/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_role/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$choices = ['admin' => get_string('administrator')];
-$roles = get_all_roles();
-foreach ($roles as $role) {
-    $choices[$role->id] = role_get_name($role);
+    $choices = ['admin' => get_string('administrator')];
+    $roles = get_all_roles();
+    foreach ($roles as $role) {
+        $choices[$role->id] = role_get_name($role);
+    }
+
+    $settings->add(new admin_setting_configmultiselect('factor_role/roles',
+        new lang_string('settings:roles', 'factor_role'),
+        new lang_string('settings:roles_help', 'factor_role'), ['admin'], $choices));
 }
-
-$settings->add(new admin_setting_configmultiselect('factor_role/roles',
-    new lang_string('settings:roles', 'factor_role'),
-    new lang_string('settings:roles_help', 'factor_role'), ['admin'], $choices));
diff --git a/admin/tool/mfa/factor/sms/settings.php b/admin/tool/mfa/factor/sms/settings.php
index 2bd2c89eb4a..d263308ef01 100644
--- a/admin/tool/mfa/factor/sms/settings.php
+++ b/admin/tool/mfa/factor/sms/settings.php
@@ -26,41 +26,43 @@
 defined('MOODLE_INTERNAL') || die();
 global $CFG, $OUTPUT;
 
-$enabled = new admin_setting_configcheckbox('factor_sms/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('sms', get_config('factor_sms', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_sms/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('sms', get_config('factor_sms', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_sms/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_sms/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_sms/duration',
-    get_string('settings:duration', 'tool_mfa'),
-    get_string('settings:duration_help', 'tool_mfa'), 30 * MINSECS, MINSECS));
+    $settings->add(new admin_setting_configduration('factor_sms/duration',
+        get_string('settings:duration', 'tool_mfa'),
+        get_string('settings:duration_help', 'tool_mfa'), 30 * MINSECS, MINSECS));
 
-$codeslink = 'https://en.wikipedia.org/wiki/List_of_country_calling_codes';
-$link = \html_writer::link($codeslink, $codeslink);
+    $codeslink = 'https://en.wikipedia.org/wiki/List_of_country_calling_codes';
+    $link = \html_writer::link($codeslink, $codeslink);
 
-$settings->add(new admin_setting_configtext('factor_sms/countrycode',
-    get_string('settings:countrycode', 'factor_sms'),
-    get_string('settings:countrycode_help', 'factor_sms', $link), '', PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_sms/countrycode',
+        get_string('settings:countrycode', 'factor_sms'),
+        get_string('settings:countrycode_help', 'factor_sms', $link), '', PARAM_INT));
 
-$gateways = [
-    'aws_sns' => get_string('settings:aws', 'factor_sms'),
-];
+    $gateways = [
+        'aws_sns' => get_string('settings:aws', 'factor_sms'),
+    ];
 
-$settings->add(new admin_setting_configselect('factor_sms/gateway',
-    get_string('settings:gateway', 'factor_sms'),
-    get_string('settings:gateway_help', 'factor_sms'),
-    'aws_sns', $gateways));
+    $settings->add(new admin_setting_configselect('factor_sms/gateway',
+        get_string('settings:gateway', 'factor_sms'),
+        get_string('settings:gateway_help', 'factor_sms'),
+        'aws_sns', $gateways));
 
-if (empty(get_config('factor_sms', 'gateway'))) {
-    return;
+    if (empty(get_config('factor_sms', 'gateway'))) {
+        return;
+    }
+
+    $class = '\factor_sms\local\smsgateway\\' . get_config('factor_sms', 'gateway');
+    call_user_func($class . '::add_settings', $settings);
 }
-
-$class = '\factor_sms\local\smsgateway\\' . get_config('factor_sms', 'gateway');
-call_user_func($class . '::add_settings', $settings);
diff --git a/admin/tool/mfa/factor/token/settings.php b/admin/tool/mfa/factor/token/settings.php
index 01296fb5025..5ebc7007e35 100644
--- a/admin/tool/mfa/factor/token/settings.php
+++ b/admin/tool/mfa/factor/token/settings.php
@@ -26,22 +26,24 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_token/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('token', get_config('factor_token', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_token/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('token', get_config('factor_token', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_token/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_token/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_token/expiry',
-    new lang_string('settings:expiry', 'factor_token'),
-    new lang_string('settings:expiry_help', 'factor_token'), DAYSECS));
+    $settings->add(new admin_setting_configduration('factor_token/expiry',
+        new lang_string('settings:expiry', 'factor_token'),
+        new lang_string('settings:expiry_help', 'factor_token'), DAYSECS));
 
-$settings->add(new admin_setting_configcheckbox('factor_token/expireovernight',
-    new lang_string('settings:expireovernight', 'factor_token'),
-    new lang_string('settings:expireovernight_help', 'factor_token'), 1));
+    $settings->add(new admin_setting_configcheckbox('factor_token/expireovernight',
+        new lang_string('settings:expireovernight', 'factor_token'),
+        new lang_string('settings:expireovernight_help', 'factor_token'), 1));
+}
diff --git a/admin/tool/mfa/factor/totp/settings.php b/admin/tool/mfa/factor/totp/settings.php
index d2189c8a48d..7a0166255cd 100644
--- a/admin/tool/mfa/factor/totp/settings.php
+++ b/admin/tool/mfa/factor/totp/settings.php
@@ -26,22 +26,24 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_totp/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('totp', get_config('factor_totp', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_totp/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('totp', get_config('factor_totp', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_totp/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_totp/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_totp/window',
-    new lang_string('settings:window', 'factor_totp'),
-    new lang_string('settings:window_help', 'factor_totp'), 30));
+    $settings->add(new admin_setting_configduration('factor_totp/window',
+        new lang_string('settings:window', 'factor_totp'),
+        new lang_string('settings:window_help', 'factor_totp'), 30));
 
-$settings->add(new admin_setting_configcheckbox('factor_totp/totplink',
-    new lang_string('settings:totplink', 'factor_totp'),
-    new lang_string('settings:totplink_help', 'factor_totp'), 1));
+    $settings->add(new admin_setting_configcheckbox('factor_totp/totplink',
+        new lang_string('settings:totplink', 'factor_totp'),
+        new lang_string('settings:totplink_help', 'factor_totp'), 1));
+}
diff --git a/admin/tool/mfa/factor/webauthn/settings.php b/admin/tool/mfa/factor/webauthn/settings.php
index 0db4542345a..0c70930befb 100644
--- a/admin/tool/mfa/factor/webauthn/settings.php
+++ b/admin/tool/mfa/factor/webauthn/settings.php
@@ -25,36 +25,38 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_webauthn/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function() {
-    \tool_mfa\manager::do_factor_action('webauthn', get_config('factor_webauthn', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_webauthn/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function() {
+        \tool_mfa\manager::do_factor_action('webauthn', get_config('factor_webauthn', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_webauthn/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_webauthn/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$authenticators = [
-    'usb' => get_string('authenticator:usb', 'factor_webauthn'),
-    'nfc' => get_string('authenticator:nfc', 'factor_webauthn'),
-    'ble' => get_string('authenticator:ble', 'factor_webauthn'),
-    'hybrid' => get_string('authenticator:hybrid', 'factor_webauthn'),
-    'internal' => get_string('authenticator:internal', 'factor_webauthn'),
-];
-$settings->add(new admin_setting_configmultiselect('factor_webauthn/authenticatortypes',
-    new lang_string('settings:authenticatortypes', 'factor_webauthn'),
-    new lang_string('settings:authenticatortypes_help', 'factor_webauthn'),
-    array_keys($authenticators), $authenticators));
+    $authenticators = [
+        'usb' => get_string('authenticator:usb', 'factor_webauthn'),
+        'nfc' => get_string('authenticator:nfc', 'factor_webauthn'),
+        'ble' => get_string('authenticator:ble', 'factor_webauthn'),
+        'hybrid' => get_string('authenticator:hybrid', 'factor_webauthn'),
+        'internal' => get_string('authenticator:internal', 'factor_webauthn'),
+    ];
+    $settings->add(new admin_setting_configmultiselect('factor_webauthn/authenticatortypes',
+        new lang_string('settings:authenticatortypes', 'factor_webauthn'),
+        new lang_string('settings:authenticatortypes_help', 'factor_webauthn'),
+        array_keys($authenticators), $authenticators));
 
-$settings->add(new admin_setting_configselect('factor_webauthn/userverification',
-    new lang_string('settings:userverification', 'factor_webauthn'),
-    new lang_string('settings:userverification_help', 'factor_webauthn'),
-    'preferred',
-    $userverification = [
-        'required' => get_string('userverification:required', 'factor_webauthn'),
-        'preferred' => get_string('userverification:preferred', 'factor_webauthn'),
-        'discouraged' => get_string('userverification:discouraged', 'factor_webauthn'),
-    ]));
+    $settings->add(new admin_setting_configselect('factor_webauthn/userverification',
+        new lang_string('settings:userverification', 'factor_webauthn'),
+        new lang_string('settings:userverification_help', 'factor_webauthn'),
+        'preferred',
+        $userverification = [
+            'required' => get_string('userverification:required', 'factor_webauthn'),
+            'preferred' => get_string('userverification:preferred', 'factor_webauthn'),
+            'discouraged' => get_string('userverification:discouraged', 'factor_webauthn'),
+        ]));
+}