Going to second this suggestion. Was a huge cheerleader for 2FA (still am), but what I'm finding is my admins are rejecting it because the 30-day cycle is a headache for them. One checks in on his phone, tablet, work desktop, laptop, and home pc. 5 refreshes every 30 days can be a hassle...