Already makes the crucial mistake:<p>Security people always want to "set policy" "educate on practices" and "enforce". You've already lost the battle.<p>PROVIDE SOLUTIONS. Why recommend all this "policy" when what you need to do is provide, at a minimum, a reference implementation. If you get called in as part of security architecture, PROVIDE A SOLUTION.<p>Because if you don't the devs will do the absolute minimum, and likely will have backdoors galore, especially as your policies impose real restrictions on their systems support quality of life, ability to respond to production issues, and iterate to produce features.<p>The other persistent issue with security is that it is anathema to automation, and therefore efficiency. So dovetailing with providing a solution, these practices for 2FA and SSO (which invariably involves horrible popup UIs and other hacky things) will block, say, automated backups, auditing, monitoring, etc that also require access. So be ready with those.