Entra External ID admin user flow. MFA step (TOTP / hardware key — no SMS). Session timer displayed post-login (30 min countdown). IP allowlist failure → 403 page with support contact.