Use the Microsoft account on the portal allowlist. Two-factor is enforced.
Restricted access. Activity is logged.