ah i get it!

I was trying imply that you need 2fa for the services itself so the passwort alone is useless.

Ironically office 365 has a nice implementation, where it for instance requires all admins to use MFA