Do you rely on Google directory services to manage users? Perhaps Okta or Ping SSO fronts authentication based on a Radiant Logic or OpenLDAP directory on the backend. Myriad other configurations exist, but thankfully most modern IDPs and SSO providers can be configured to accept WebAuthn(FIDO2) authenticators. Advantages of WebAuthn include less infrastructure, and more deployable flexibility while simultaneously offering phishing resistant and easy to use MFA.
If an easy to deploy and manage solution is required that supports passwordless logins, modern phishing resistant authentication, or a future proofed authentication solution, dig deeper into WebAuthn as an alternative to weaker forms of MFA.