Is two-factor authentication supported?

Yes:

• Methods: an authenticator app or a security key; SMS is not offered.
• Policy: an organization can require it of everyone.
• Step-up: sensitive actions ask for a fresh second factor.