>>"Require 2FA for everybody, full stop" would do the trick.
How do you require 2FA for the Find My iPhone application when the only context for using that application is one in which your phone is lost?
How do you require 2FA for the Find My iPhone application when the only context for using that application is one in which your phone is lost?