Maybe I'm missing the point but isn't the parent comment asking with the admin accounts had no 2FA?