Throwing my agency's hat into the "please enable app-based MFA" ring.