We love the idea of having the OTP codes in Hudu, but hate the idea that if one system is compromised, then both factors are given the the attacker. It would be great if we would require an MFA push notification (I realize I'm assuming everyone has Azure SSO with push notifications enabled) when trying to access the OTP (or even the password) to protect against this.