Add 2FA/MFA support for user login

Administrators want an additional authentication factor for user logins to strengthen account security, particularly for external users and accounts with elevated privileges. Possible options include one-time codes sent by email and standard authenticator apps such as Google Authenticator or Microsoft Authenticator. Problem / Pain There is currently no 2FA/MFA option for user accounts. Login relies on a single factor, such as a password, which provides fewer safeguards if login credentials are compromised, particularly for external users whose account security practices may be outside the organization’s direct control. Impact / Benefit An additional authentication factor would strengthen access protection for user accounts and provide more control over how sensitive accounts are secured. This is particularly relevant for external or third-party users and for internal accounts with elevated privileges. Two possible options could support different user types: OTP via email: A one-time code sent to the user’s registered email address during login, which could be suitable for external users who do not want to use an authenticator app. Authenticator app (TOTP): Support for standard authenticator apps such as Google Authenticator or Microsoft Authenticator. Example use case An external contributor logs in with standalone credentials rather than through federated or SSO access. 2FA/MFA would add an additional authentication step to the login process. The same option could also be used for internal accounts with elevated privileges, such as administrators.