thats a good idea, since we have 2FA on our ADFS, which is used for every single authentication for SSO