and there's the little part about adfs not including any integrated two-factor for external users. Someone can basically sit here all day and bang away at mail

and there's the little part about adfs not including any integrated two-factor for external users. Someone can basically sit here all day and bang away at mail.google.com/a/doi.gov with accounts like Bob_Abbey@ios.doi.gov or Ken_Salazar@ios.doi.gov (just google @ios.doi.gov) and it'll never lock out access from your ip.