Many enterprise apps you can force it or depend on authentication from Google or Azure kind of SSO providers, who have this feature. Consumer apps try hard no

Many enterprise apps you can force it or depend on authentication from Google or Azure kind of SSO providers, who have this feature. Consumer apps try hard not to do hard security unless they are forced to, usually for cost reasons. Security measures like these create a ton of administrative tickets - check any sysad ticket queue a good chunk is password reset/recovery, in enterprise apps the org sysads are paid to handle this. In consumer apps, the app company has to manage it, also it lot harder to verify identity of a random user than company employees making it harder to do this kind of support. A good jarring example is AWS, the amazon.com and AWS did (does?) share authentication stack so some basic 2FA functionality like backup codes is not there for AWS . Google is better at this because they have for long time also focused on SSO service as a product. Many companies use Google AD /SSO workspace/suite because third party apps support google login out-of the box free[1], maybe charge for AzureAD/SAML2 and likely not support others at all without customization costs. [1]It is standard because SMB/mid market companies are more likely to use Google for productivity than Azure/o365 as it is easier to manage albeit with lesser features. Third party apps don't want to expend support time on smaller customers if they can avoid it