Watch this video on YouTube
Does the configuration of app-specific settings require devices to be managed by an organization? Do Conditional Access policies allow you to require multi-factor authentication for users with administrative roles ?