Most services don't have a good way to restrict 2fa to certain keys which would be required for that. Also that would still mean rotating any tokens/m2m keys t

Most services don't have a good way to restrict 2fa to certain keys which would be required for that. Also that would still mean rotating any tokens/m2m keys that have been issued. The "proper way" would be to try to minimize how many tokens/keys are readable by employees (they should probably be only read by deployment jobs etc.) and use SSO for interactive logins. When offboarding a user it should be enough to remove the user from the SSO provider and rotate any tokens/m2m keys that the employee actually had access to (as long as the employee did not get access to issue new tokens). Unfortunately a lot of services treat SSO as a "premium" feature and require "call us" enterprise plans for it.