switch back between groups depending on MFA status.
fixed typo is readonlygroup resource name