We're currently using PlayFab for our title but one of our primary concerns is the lack of 2FA support in the authentication flow when using PlayFab as the identity provider. We could setup an authentication layer in front of PlayFab to support 2FA via a One-Time-Password code system but this would cause several issues, and would require us to maintain and scale our own authentication service.
It would be better if PlayFab supported accounts enabling 2FA, and if enabled authorized just a route for verifying the code, which would return the full-access JWT for the PlayFab user on success. It's rather simple to setup, wouldn't effect existing titles, and would help secure player accounts from being stolen via credential-stuffing attacks which is very common.
