Is admin 2FA really mandatory on Magento 2.4.x?

Yes, Magento has shipped built-in 2FA since 2.4.0 via the Magento_TwoFactorAuth module, and it’s enabled by default. The supported providers are Google Authenticator, Authy, Duo Security, and U2F hardware keys.

What the audit checks is whether every admin user is enforced to use it, not whether the module is installed. Two common gaps I see:

• The module is enabled but admins can dismiss the setup prompt. Fix: php bin/magento config:set twofactorauth/general/force_providers google so the prompt is non-dismissible.
• Some admins use IP-allowlist bypass tokens. The bypass token mechanism is fine for emergency access but should be 1-time-use and rotated quarterly, not standing entries.

The Adobe Commerce hosted edition adds SSO via SAML/OAuth, which counts as 2FA for the purposes of this audit (assuming your IdP enforces MFA). If you’re on Open Source self-hosted, the built-in TOTP is the baseline.

Cost: $0. Effort: ~2 hours to enforce + train the admin team. There is no excuse for a "No" on q1.