Who is off, who is on support.
Password and a six-digit code, once per day per device. Lost your code? Ask an SSO administrator for a reset link.
Only when single sign-on is down. Every use is logged.