Or even better: google accounts with the Google Authenticator on your phone, then require a Duo push auth. ML with some hard rules for when to require a second

Or even better: google accounts with the Google Authenticator on your phone, then require a Duo push auth. ML with some hard rules for when to require a second or third factor, like "always" when it's an admin account.