User member of multiple AD Groups - why not working for MFA / 2FA?

MFA is bound to the primary group. Other group memberships are not used for the Group Flag. 

I think you mean the MFA flag?

Is this situation good? Nested AD groups still not working, SFOS just picking the "first" group as primary - how do you change that?

Personally i was never a fan of Nested Groups, they bring to much complexity within the AD in the long run. 
But Primary Group is used for some of the Sub Systems. Like MFA as well. 

I also have a split opinion about nesting - they have advantages and disadvantages.

But in our case - no nesting active - how can we change the primary group on SFOS from GroupA to GroupB for a bunch of users while they still remain in GroupA?

My thoughts about this:  Sophos Firewall: Backend Group Membership in Sophos Firewall 

You can change the primary group by changing the order. 
Keep in mind, the primary group is used for multiple services. 

Today after re-ordering the AD groups on SFOS we noticed the groups of Administrators of Hotspot did no longer have access to the Hotspots in their user portal.

It is really a pain that SFOS actually IS aware of multiple group memberships of a user but is unable to use them for many of it's facilities like MFA or here Hotspot.

This is totally against the logic of using groups.

We have AD groups that allow some users access to some FW destinations only when they are member of Group A

There is no need for that Group A to have MFA or Hotspot or SSL VPN.

On the other hand, we have Group B that has Admin permissions in a Hotspot. It's members do not belong to Group A.

Group C allows some users for SSL VPN. Of course SSL VPN Users require MFA. When we add Group C to MFA users, we need to be sure, that Group C is the primary Group for the user so SFOS can handle the MFA facility. Group C should not have Hotspot Admin permissions, but some users of Group C do.

and so on.

Now we need to add single users as Hotspot admins, single users to MFA or other facilities like SSL VPN.

You cannot do it right way.

We wouldn't have any issues when SFOS would finally be capable of using all of the User's Group memberships EVERYWHERE!

We understand the frustration here, it is on our radar to adjust the Backend Membership for multiple services for more than Firewalling, Web and SSLVPN. Right now we cannot give a commitment, when we are addressing this. 

I feed you. The incomplete implementation of multiple AD Groups is kind of PITA!