> From a corporate standpoint, I don't want people using their personal devices for SMS OTP (2fa) because then if they leave, are disgruntled or get tragically hit by a bus I am locked out of a potentially important service/account. I had this happen on three accounts in the past year where one took me 3 days to recover the ability to access it, another I never could recover and we had to work around it and a third that was absolutely critical but took close to two weeks all said (lots of waiting)

Wait...I've seen two ways for services to handle multiple users from a client using the same account.

1. A company using the service gets a single user login for their account. That login is shared by all of the employees who use the service.

2. A company using the service starts out with a single user login for the account. That login is meant to only be used to administer the account. The administrator can create more user logins for the account, usually with reduced privileges. Each employee is given a separate login of their own, with just the privileges needed to do their job.

I don't think I've seen a #1 that uses 2FA. I assumed that was because it could then easily run into the problem you describe.

With #2 there is no problem using 2FA, or with each user using their own device for 2FA. The only account you have make sure won't be lost if someone gets hit by a bus is the administrator account.

Did you run into a service using approach #1 but that used SMS OTP?