diff --git a/admin/tool/mfa/classes/plugininfo/factor.php b/admin/tool/mfa/classes/plugininfo/factor.php
index ce4118d5208..b1344027176 100644
--- a/admin/tool/mfa/classes/plugininfo/factor.php
+++ b/admin/tool/mfa/classes/plugininfo/factor.php
@@ -256,6 +256,10 @@ class factor extends \core\plugininfo\base {
      * @param bool $hassiteconfig whether the current user has moodle/site:config capability
      */
     public function load_settings(\part_of_admin_tree $adminroot, $parentnodename, $hassiteconfig): void {
+        global $CFG, $USER, $DB, $OUTPUT, $PAGE; // In case settings.php wants to refer to them.
+        /** @var \admin_root $ADMIN */
+        $ADMIN = $adminroot; // May be used in settings.php.
+        $plugininfo = $this; // Also can be used inside settings.php.
 
         if (!$this->is_installed_and_upgraded()) {
             return;
@@ -269,9 +273,7 @@ class factor extends \core\plugininfo\base {
 
         $settings = new \admin_settingpage($section, $this->displayname, 'moodle/site:config', $this->is_enabled() === false);
 
-        if ($adminroot->fulltree) {
-            include($this->full_path('settings.php'));
-        }
+        include($this->full_path('settings.php'));
 
         $adminroot->add($parentnodename, $settings);
     }
diff --git a/admin/tool/mfa/factor/admin/settings.php b/admin/tool/mfa/factor/admin/settings.php
index 2520cd7baa7..9135db27b67 100644
--- a/admin/tool/mfa/factor/admin/settings.php
+++ b/admin/tool/mfa/factor/admin/settings.php
@@ -25,14 +25,16 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_admin/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('admin', get_config('factor_admin', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_admin/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('admin', get_config('factor_admin', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_admin/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'factor_admin'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_admin/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'factor_admin'), 100, PARAM_INT));
+}
diff --git a/admin/tool/mfa/factor/auth/settings.php b/admin/tool/mfa/factor/auth/settings.php
index c61009cba58..23a5126879b 100644
--- a/admin/tool/mfa/factor/auth/settings.php
+++ b/admin/tool/mfa/factor/auth/settings.php
@@ -25,25 +25,27 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_auth/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('auth', get_config('factor_auth', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_auth/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('auth', get_config('factor_auth', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_auth/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_auth/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$authtypes = get_enabled_auth_plugins(true);
-$authselect = [];
-foreach ($authtypes as $type) {
-    $auth = get_auth_plugin($type);
-    $authselect[$type] = $auth->get_title();
+    $authtypes = get_enabled_auth_plugins(true);
+    $authselect = [];
+    foreach ($authtypes as $type) {
+        $auth = get_auth_plugin($type);
+        $authselect[$type] = $auth->get_title();
+    }
+
+    $settings->add(new admin_setting_configmulticheckbox('factor_auth/goodauth',
+        get_string('settings:goodauth', 'factor_auth'),
+        get_string('settings:goodauth_help', 'factor_auth'), [], $authselect));
 }
-
-$settings->add(new admin_setting_configmulticheckbox('factor_auth/goodauth',
-    get_string('settings:goodauth', 'factor_auth'),
-    get_string('settings:goodauth_help', 'factor_auth'), [], $authselect));
diff --git a/admin/tool/mfa/factor/capability/settings.php b/admin/tool/mfa/factor/capability/settings.php
index d5d1be595e2..d662880dd7c 100644
--- a/admin/tool/mfa/factor/capability/settings.php
+++ b/admin/tool/mfa/factor/capability/settings.php
@@ -25,19 +25,21 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_capability/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('capability', get_config('factor_capability', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_capability/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('capability', get_config('factor_capability', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_capability/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_capability/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-// Admin passes bool logic is inverted due to negative capability check.
-$settings->add(new admin_setting_configcheckbox('factor_capability/adminpasses',
-    new lang_string('settings:adminpasses', 'factor_capability'),
-    new lang_string('settings:adminpasses_help', 'factor_capability'), 1, 0, 1));
+    // Admin passes bool logic is inverted due to negative capability check.
+    $settings->add(new admin_setting_configcheckbox('factor_capability/adminpasses',
+        new lang_string('settings:adminpasses', 'factor_capability'),
+        new lang_string('settings:adminpasses_help', 'factor_capability'), 1, 0, 1));
+}
diff --git a/admin/tool/mfa/factor/cohort/settings.php b/admin/tool/mfa/factor/cohort/settings.php
index 08aede8d5ed..a2ded7b51e4 100644
--- a/admin/tool/mfa/factor/cohort/settings.php
+++ b/admin/tool/mfa/factor/cohort/settings.php
@@ -26,27 +26,29 @@
 defined('MOODLE_INTERNAL') || die();
 require_once(__DIR__ . '/../../../../../cohort/lib.php');
 
-$enabled = new admin_setting_configcheckbox('factor_cohort/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('cohort', get_config('factor_cohort', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_cohort/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('cohort', get_config('factor_cohort', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_cohort/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_cohort/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$cohorts = cohort_get_all_cohorts();
-$choices = [];
+    $cohorts = cohort_get_all_cohorts();
+    $choices = [];
 
-foreach ($cohorts['cohorts'] as $cohort) {
-    $choices[$cohort->id] = $cohort->name;
-}
+    foreach ($cohorts['cohorts'] as $cohort) {
+        $choices[$cohort->id] = $cohort->name;
+    }
 
-if (!empty($choices)) {
-    $settings->add(new admin_setting_configmultiselect('factor_cohort/cohorts',
-    new lang_string('settings:cohort', 'factor_cohort'),
-    new lang_string('settings:cohort_help', 'factor_cohort'), [], $choices));
+    if (!empty($choices)) {
+        $settings->add(new admin_setting_configmultiselect('factor_cohort/cohorts',
+        new lang_string('settings:cohort', 'factor_cohort'),
+        new lang_string('settings:cohort_help', 'factor_cohort'), [], $choices));
+    }
 }
diff --git a/admin/tool/mfa/factor/email/settings.php b/admin/tool/mfa/factor/email/settings.php
index cf44edf0c48..8ebf75d4cfb 100644
--- a/admin/tool/mfa/factor/email/settings.php
+++ b/admin/tool/mfa/factor/email/settings.php
@@ -25,22 +25,24 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_email/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('email', get_config('factor_email', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_email/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('email', get_config('factor_email', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_email/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_email/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_email/duration',
-    get_string('settings:duration', 'factor_email'),
-    get_string('settings:duration_help', 'factor_email'), 30 * MINSECS, MINSECS));
+    $settings->add(new admin_setting_configduration('factor_email/duration',
+        get_string('settings:duration', 'factor_email'),
+        get_string('settings:duration_help', 'factor_email'), 30 * MINSECS, MINSECS));
 
-$settings->add(new admin_setting_configcheckbox('factor_email/suspend',
-    get_string('settings:suspend', 'factor_email'),
-    get_string('settings:suspend_help', 'factor_email'), 0));
+    $settings->add(new admin_setting_configcheckbox('factor_email/suspend',
+        get_string('settings:suspend', 'factor_email'),
+        get_string('settings:suspend_help', 'factor_email'), 0));
+}
diff --git a/admin/tool/mfa/factor/grace/settings.php b/admin/tool/mfa/factor/grace/settings.php
index eb1448bd2fc..231c3aed312 100644
--- a/admin/tool/mfa/factor/grace/settings.php
+++ b/admin/tool/mfa/factor/grace/settings.php
@@ -25,36 +25,38 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_grace/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('grace', get_config('factor_grace', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_grace/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('grace', get_config('factor_grace', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_grace/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_grace/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configcheckbox('factor_grace/forcesetup',
-    new lang_string('settings:forcesetup', 'factor_grace'),
-    new lang_string('settings:forcesetup_help', 'factor_grace'), 0));
+    $settings->add(new admin_setting_configcheckbox('factor_grace/forcesetup',
+        new lang_string('settings:forcesetup', 'factor_grace'),
+        new lang_string('settings:forcesetup_help', 'factor_grace'), 0));
 
-$settings->add(new admin_setting_configduration('factor_grace/graceperiod',
-    new lang_string('settings:graceperiod', 'factor_grace'),
-    new lang_string('settings:graceperiod_help', 'factor_grace'), '604800'));
+    $settings->add(new admin_setting_configduration('factor_grace/graceperiod',
+        new lang_string('settings:graceperiod', 'factor_grace'),
+        new lang_string('settings:graceperiod_help', 'factor_grace'), '604800'));
 
-$gracefactor = \tool_mfa\plugininfo\factor::get_factor('grace');
-$factors = $gracefactor->get_all_affecting_factors();
-$gracefactors = [];
-foreach ($factors as $factor) {
-    $gracefactors[$factor->name] = $factor->get_display_name();
+    $gracefactor = \tool_mfa\plugininfo\factor::get_factor('grace');
+    $factors = $gracefactor->get_all_affecting_factors();
+    $gracefactors = [];
+    foreach ($factors as $factor) {
+        $gracefactors[$factor->name] = $factor->get_display_name();
+    }
+    $settings->add(new admin_setting_configmultiselect('factor_grace/ignorelist',
+        new lang_string('settings:ignorelist', 'factor_grace'),
+        new lang_string('settings:ignorelist_help', 'factor_grace'), [], $gracefactors));
+
+    $settings->add(new admin_setting_confightmleditor('factor_grace/customwarning',
+        new lang_string('settings:customwarning', 'factor_grace'),
+        new lang_string('settings:customwarning_help', 'factor_grace'), '', PARAM_RAW));
 }
-$settings->add(new admin_setting_configmultiselect('factor_grace/ignorelist',
-    new lang_string('settings:ignorelist', 'factor_grace'),
-    new lang_string('settings:ignorelist_help', 'factor_grace'), [], $gracefactors));
-
-$settings->add(new admin_setting_confightmleditor('factor_grace/customwarning',
-    new lang_string('settings:customwarning', 'factor_grace'),
-    new lang_string('settings:customwarning_help', 'factor_grace'), '', PARAM_RAW));
diff --git a/admin/tool/mfa/factor/iprange/settings.php b/admin/tool/mfa/factor/iprange/settings.php
index 463503a111a..f75d4df6d7f 100644
--- a/admin/tool/mfa/factor/iprange/settings.php
+++ b/admin/tool/mfa/factor/iprange/settings.php
@@ -27,35 +27,36 @@ defined('MOODLE_INTERNAL') || die();
 
 global $OUTPUT;
 
-$enabled = new admin_setting_configcheckbox('factor_iprange/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('iprange', get_config('factor_iprange', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_iprange/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('iprange', get_config('factor_iprange', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_iprange/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_iprange/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
 
-// Current IP validation against list for description.
-$allowedips = get_config('factor_iprange', 'safeips');
-if (trim($allowedips) == '') {
-    $message = 'allowedipsempty';
-    $type = 'notifyerror';
-} else if (remoteip_in_list($allowedips)) {
-    $message = 'allowedipshasmyip';
-    $type = 'notifysuccess';
-} else {
-    $message = 'allowedipshasntmyip';
-    $type = 'notifyerror';
-};
-$info = $OUTPUT->notification(get_string($message, 'factor_iprange', ['ip' => getremoteaddr()]), $type);
-
-$settings->add(new admin_setting_configiplist('factor_iprange/safeips',
-    new lang_string('settings:safeips', 'factor_iprange'),
-    new lang_string('settings:safeips_help', 'factor_iprange',
-            ['info' => $info, 'syntax' => get_string('ipblockersyntax', 'admin')]), '', PARAM_TEXT));
+    // Current IP validation against list for description.
+    $allowedips = get_config('factor_iprange', 'safeips');
+    if (trim($allowedips) == '') {
+        $message = 'allowedipsempty';
+        $type = 'notifyerror';
+    } else if (remoteip_in_list($allowedips)) {
+        $message = 'allowedipshasmyip';
+        $type = 'notifysuccess';
+    } else {
+        $message = 'allowedipshasntmyip';
+        $type = 'notifyerror';
+    };
+    $info = $OUTPUT->notification(get_string($message, 'factor_iprange', ['ip' => getremoteaddr()]), $type);
 
+    $settings->add(new admin_setting_configiplist('factor_iprange/safeips',
+        new lang_string('settings:safeips', 'factor_iprange'),
+        new lang_string('settings:safeips_help', 'factor_iprange',
+                ['info' => $info, 'syntax' => get_string('ipblockersyntax', 'admin')]), '', PARAM_TEXT));
+}
diff --git a/admin/tool/mfa/factor/nosetup/settings.php b/admin/tool/mfa/factor/nosetup/settings.php
index 679d2e8b160..2742b6537c4 100644
--- a/admin/tool/mfa/factor/nosetup/settings.php
+++ b/admin/tool/mfa/factor/nosetup/settings.php
@@ -25,14 +25,16 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_nosetup/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('nosetup', get_config('factor_nosetup', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_nosetup/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('nosetup', get_config('factor_nosetup', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_nosetup/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_nosetup/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+}
diff --git a/admin/tool/mfa/factor/role/settings.php b/admin/tool/mfa/factor/role/settings.php
index 4645638c348..9e62f9a9da7 100644
--- a/admin/tool/mfa/factor/role/settings.php
+++ b/admin/tool/mfa/factor/role/settings.php
@@ -25,24 +25,26 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_role/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('role', get_config('factor_role', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_role/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('role', get_config('factor_role', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_role/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_role/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$choices = ['admin' => get_string('administrator')];
-$roles = get_all_roles();
-foreach ($roles as $role) {
-    $choices[$role->id] = role_get_name($role);
+    $choices = ['admin' => get_string('administrator')];
+    $roles = get_all_roles();
+    foreach ($roles as $role) {
+        $choices[$role->id] = role_get_name($role);
+    }
+
+    $settings->add(new admin_setting_configmultiselect('factor_role/roles',
+        new lang_string('settings:roles', 'factor_role'),
+        new lang_string('settings:roles_help', 'factor_role'), ['admin'], $choices));
 }
-
-$settings->add(new admin_setting_configmultiselect('factor_role/roles',
-    new lang_string('settings:roles', 'factor_role'),
-    new lang_string('settings:roles_help', 'factor_role'), ['admin'], $choices));
diff --git a/admin/tool/mfa/factor/sms/settings.php b/admin/tool/mfa/factor/sms/settings.php
index 8b0d8dfb604..95c2cbbdb9f 100644
--- a/admin/tool/mfa/factor/sms/settings.php
+++ b/admin/tool/mfa/factor/sms/settings.php
@@ -25,95 +25,96 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-global $CFG;
-// Get the gateway records.
-$manager = \core\di::get(\core_sms\manager::class);
-$gatewayrecords = $manager->get_gateway_records(['enabled' => 1]);
-$smsconfigureurl = new moodle_url(
-    '/sms/configure.php',
-    [
-        'returnurl' => new moodle_url(
-            '/admin/settings.php',
-            ['section' => 'factor_sms'],
-        ),
-    ],
-);
-$smsconfigureurl = $smsconfigureurl->out();
-
-$settings->add(
-    new admin_setting_heading(
-        'factor_sms/heading',
-        '',
-        new lang_string(
-            'settings:heading',
-            'factor_sms',
-        ),
-    ),
-);
-
-if (count($gatewayrecords) > 0) {
-    $gateways = [0 => new lang_string('none')];
-    foreach ($gatewayrecords as $record) {
-        $values = explode('\\', $record->gateway);
-        $gatewayname = new lang_string('pluginname', $values[0]);
-        $gateways[$record->id] = $record->name . ' (' . $gatewayname . ')';
-    }
+if ($ADMIN->fulltree) {
+    // Get the gateway records.
+    $manager = \core\di::get(\core_sms\manager::class);
+    $gatewayrecords = $manager->get_gateway_records(['enabled' => 1]);
+    $smsconfigureurl = new moodle_url(
+        '/sms/configure.php',
+        [
+            'returnurl' => new moodle_url(
+                '/admin/settings.php',
+                ['section' => 'factor_sms'],
+            ),
+        ],
+    );
+    $smsconfigureurl = $smsconfigureurl->out();
 
     $settings->add(
-        new admin_setting_configselect(
-            'factor_sms/smsgateway',
-            new lang_string('settings:smsgateway', 'factor_sms'),
-            new lang_string('settings:smsgateway_help', 'factor_sms', $smsconfigureurl),
-            0,
-            $gateways,
-        ),
-    );
-
-    $enabled = new admin_setting_configcheckbox(
-        'factor_sms/enabled',
-        new lang_string('settings:enablefactor', 'tool_mfa'),
-        new lang_string('settings:enablefactor_help', 'tool_mfa'),
-        0,
-    );
-    $enabled->set_updatedcallback(function () {
-        \tool_mfa\manager::do_factor_action(
-            'sms',
-            get_config('factor_sms', 'enabled') ? 'enable' : 'disable',
-        );
-    });
-    $settings->add($enabled);
-
-    $settings->add(
-        new admin_setting_configtext(
-            'factor_sms/weight',
-            new lang_string('settings:weight', 'tool_mfa'),
-            new lang_string('settings:weight_help', 'tool_mfa'),
-            100,
-            PARAM_INT,
-        ),
-    );
-    $settings->hide_if('factor_sms/weight', 'factor_sms/enabled');
-
-    $settings->add(
-        new admin_setting_configduration(
-            'factor_sms/duration',
-            new lang_string('settings:duration', 'tool_mfa'),
-            new lang_string('settings:duration_help', 'tool_mfa'),
-            30 * MINSECS,
-            MINSECS,
-        ),
-    );
-    $settings->hide_if('factor_sms/duration', 'factor_sms/enabled');
-} else {
-    $settings->add(
-        new admin_setting_description(
-            'factor_sms/setupdesc',
+        new admin_setting_heading(
+            'factor_sms/heading',
             '',
             new lang_string(
-                'settings:setupdesc',
+                'settings:heading',
                 'factor_sms',
-                $smsconfigureurl,
             ),
         ),
     );
+
+    if (count($gatewayrecords) > 0) {
+        $gateways = [0 => new lang_string('none')];
+        foreach ($gatewayrecords as $record) {
+            $values = explode('\\', $record->gateway);
+            $gatewayname = new lang_string('pluginname', $values[0]);
+            $gateways[$record->id] = $record->name . ' (' . $gatewayname . ')';
+        }
+
+        $settings->add(
+            new admin_setting_configselect(
+                'factor_sms/smsgateway',
+                new lang_string('settings:smsgateway', 'factor_sms'),
+                new lang_string('settings:smsgateway_help', 'factor_sms', $smsconfigureurl),
+                0,
+                $gateways,
+            ),
+        );
+
+        $enabled = new admin_setting_configcheckbox(
+            'factor_sms/enabled',
+            new lang_string('settings:enablefactor', 'tool_mfa'),
+            new lang_string('settings:enablefactor_help', 'tool_mfa'),
+            0,
+        );
+        $enabled->set_updatedcallback(function () {
+            \tool_mfa\manager::do_factor_action(
+                'sms',
+                get_config('factor_sms', 'enabled') ? 'enable' : 'disable',
+            );
+        });
+        $settings->add($enabled);
+
+        $settings->add(
+            new admin_setting_configtext(
+                'factor_sms/weight',
+                new lang_string('settings:weight', 'tool_mfa'),
+                new lang_string('settings:weight_help', 'tool_mfa'),
+                100,
+                PARAM_INT,
+            ),
+        );
+        $settings->hide_if('factor_sms/weight', 'factor_sms/enabled');
+
+        $settings->add(
+            new admin_setting_configduration(
+                'factor_sms/duration',
+                new lang_string('settings:duration', 'tool_mfa'),
+                new lang_string('settings:duration_help', 'tool_mfa'),
+                30 * MINSECS,
+                MINSECS,
+            ),
+        );
+        $settings->hide_if('factor_sms/duration', 'factor_sms/enabled');
+    } else {
+        $settings->add(
+            new admin_setting_description(
+                'factor_sms/setupdesc',
+                '',
+                new lang_string(
+                    'settings:setupdesc',
+                    'factor_sms',
+                    $smsconfigureurl,
+                ),
+            ),
+        );
+    }
 }
diff --git a/admin/tool/mfa/factor/token/settings.php b/admin/tool/mfa/factor/token/settings.php
index 01296fb5025..5ebc7007e35 100644
--- a/admin/tool/mfa/factor/token/settings.php
+++ b/admin/tool/mfa/factor/token/settings.php
@@ -26,22 +26,24 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_token/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('token', get_config('factor_token', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_token/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('token', get_config('factor_token', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_token/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_token/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$settings->add(new admin_setting_configduration('factor_token/expiry',
-    new lang_string('settings:expiry', 'factor_token'),
-    new lang_string('settings:expiry_help', 'factor_token'), DAYSECS));
+    $settings->add(new admin_setting_configduration('factor_token/expiry',
+        new lang_string('settings:expiry', 'factor_token'),
+        new lang_string('settings:expiry_help', 'factor_token'), DAYSECS));
 
-$settings->add(new admin_setting_configcheckbox('factor_token/expireovernight',
-    new lang_string('settings:expireovernight', 'factor_token'),
-    new lang_string('settings:expireovernight_help', 'factor_token'), 1));
+    $settings->add(new admin_setting_configcheckbox('factor_token/expireovernight',
+        new lang_string('settings:expireovernight', 'factor_token'),
+        new lang_string('settings:expireovernight_help', 'factor_token'), 1));
+}
diff --git a/admin/tool/mfa/factor/totp/settings.php b/admin/tool/mfa/factor/totp/settings.php
index 7e752d865e7..df416ee5ac7 100644
--- a/admin/tool/mfa/factor/totp/settings.php
+++ b/admin/tool/mfa/factor/totp/settings.php
@@ -26,24 +26,26 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_totp/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function () {
-    \tool_mfa\manager::do_factor_action('totp', get_config('factor_totp', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_totp/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function () {
+        \tool_mfa\manager::do_factor_action('totp', get_config('factor_totp', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_totp/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_totp/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$window = new admin_setting_configduration('factor_totp/window',
-    new lang_string('settings:window', 'factor_totp'),
-    new lang_string('settings:window_help', 'factor_totp'), 15);
-$window->set_max_duration(29);
-$settings->add($window);
+    $window = new admin_setting_configduration('factor_totp/window',
+        new lang_string('settings:window', 'factor_totp'),
+        new lang_string('settings:window_help', 'factor_totp'), 15);
+    $window->set_max_duration(29);
+    $settings->add($window);
 
-$settings->add(new admin_setting_configcheckbox('factor_totp/totplink',
-    new lang_string('settings:totplink', 'factor_totp'),
-    new lang_string('settings:totplink_help', 'factor_totp'), 1));
+    $settings->add(new admin_setting_configcheckbox('factor_totp/totplink',
+        new lang_string('settings:totplink', 'factor_totp'),
+        new lang_string('settings:totplink_help', 'factor_totp'), 1));
+}
diff --git a/admin/tool/mfa/factor/webauthn/settings.php b/admin/tool/mfa/factor/webauthn/settings.php
index 0db4542345a..0c70930befb 100644
--- a/admin/tool/mfa/factor/webauthn/settings.php
+++ b/admin/tool/mfa/factor/webauthn/settings.php
@@ -25,36 +25,38 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$enabled = new admin_setting_configcheckbox('factor_webauthn/enabled',
-    new lang_string('settings:enablefactor', 'tool_mfa'),
-    new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
-$enabled->set_updatedcallback(function() {
-    \tool_mfa\manager::do_factor_action('webauthn', get_config('factor_webauthn', 'enabled') ? 'enable' : 'disable');
-});
-$settings->add($enabled);
+if ($ADMIN->fulltree) {
+    $enabled = new admin_setting_configcheckbox('factor_webauthn/enabled',
+        new lang_string('settings:enablefactor', 'tool_mfa'),
+        new lang_string('settings:enablefactor_help', 'tool_mfa'), 0);
+    $enabled->set_updatedcallback(function() {
+        \tool_mfa\manager::do_factor_action('webauthn', get_config('factor_webauthn', 'enabled') ? 'enable' : 'disable');
+    });
+    $settings->add($enabled);
 
-$settings->add(new admin_setting_configtext('factor_webauthn/weight',
-    new lang_string('settings:weight', 'tool_mfa'),
-    new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
+    $settings->add(new admin_setting_configtext('factor_webauthn/weight',
+        new lang_string('settings:weight', 'tool_mfa'),
+        new lang_string('settings:weight_help', 'tool_mfa'), 100, PARAM_INT));
 
-$authenticators = [
-    'usb' => get_string('authenticator:usb', 'factor_webauthn'),
-    'nfc' => get_string('authenticator:nfc', 'factor_webauthn'),
-    'ble' => get_string('authenticator:ble', 'factor_webauthn'),
-    'hybrid' => get_string('authenticator:hybrid', 'factor_webauthn'),
-    'internal' => get_string('authenticator:internal', 'factor_webauthn'),
-];
-$settings->add(new admin_setting_configmultiselect('factor_webauthn/authenticatortypes',
-    new lang_string('settings:authenticatortypes', 'factor_webauthn'),
-    new lang_string('settings:authenticatortypes_help', 'factor_webauthn'),
-    array_keys($authenticators), $authenticators));
+    $authenticators = [
+        'usb' => get_string('authenticator:usb', 'factor_webauthn'),
+        'nfc' => get_string('authenticator:nfc', 'factor_webauthn'),
+        'ble' => get_string('authenticator:ble', 'factor_webauthn'),
+        'hybrid' => get_string('authenticator:hybrid', 'factor_webauthn'),
+        'internal' => get_string('authenticator:internal', 'factor_webauthn'),
+    ];
+    $settings->add(new admin_setting_configmultiselect('factor_webauthn/authenticatortypes',
+        new lang_string('settings:authenticatortypes', 'factor_webauthn'),
+        new lang_string('settings:authenticatortypes_help', 'factor_webauthn'),
+        array_keys($authenticators), $authenticators));
 
-$settings->add(new admin_setting_configselect('factor_webauthn/userverification',
-    new lang_string('settings:userverification', 'factor_webauthn'),
-    new lang_string('settings:userverification_help', 'factor_webauthn'),
-    'preferred',
-    $userverification = [
-        'required' => get_string('userverification:required', 'factor_webauthn'),
-        'preferred' => get_string('userverification:preferred', 'factor_webauthn'),
-        'discouraged' => get_string('userverification:discouraged', 'factor_webauthn'),
-    ]));
+    $settings->add(new admin_setting_configselect('factor_webauthn/userverification',
+        new lang_string('settings:userverification', 'factor_webauthn'),
+        new lang_string('settings:userverification_help', 'factor_webauthn'),
+        'preferred',
+        $userverification = [
+            'required' => get_string('userverification:required', 'factor_webauthn'),
+            'preferred' => get_string('userverification:preferred', 'factor_webauthn'),
+            'discouraged' => get_string('userverification:discouraged', 'factor_webauthn'),
+        ]));
+}