You can give IAM users permission to add their own MFA device. I’d recommend requiring MFA to remove the device to prevent an attacker from doing so