Enable 2 Factor Authentication (2FA)
You can allow users to set a cookie so that they are not asked for the secondary authentication often. You can specify
0 as the days for cookie to always force 2FA.
If you are using Duo, you will need to fill in a few details obtained from your Duo account.
Reset Google Authenticator For Any USer
Any user who accidentally deleted his Google Authenticator account or has lost access to the Authenticator app will need to have her account reset. The Administrator can do this by simply deactivating the user and then activating her again. The user can then enter the initialization code again to reset the Authenticator account.