Concerns: Can't require 2FA in Office when domain not owned by application owner, 2FA optional in Meta, can't raise password standards, i.e. check pwned, broad customer base with many e-mail preferences who are not interested in yet another e-mail address, and can't require non-email based 2FA

Nice helpful post that doubles for some tips. FYI: The Github site for the Progress Bar plugin URL notes it is no longer maintained referring people to the FOS progress bar plugin, that that transitioned to a United-Codes maintained Plugin.