[_fool]

I work for netlify. We support 2FA on any tier, since you can auth via git provider and require 2FA there.

We presently don't support REQUIRED 2FA (you can also set a password) under the enterprise account level, since that's what enables SSO using a SAML-based identity provider and enforcing those limits there.

[philsnow]

Thanks for the answer from a direct source :)

A core part of Netlify's offering (any SaaS's offering really) is some kind of guarantee that attackers can't get in and vandalize users' sites. When you delegate authentication to an identity provider (whether that's through OAuth2/OIDC or SAML), you're delegating that core feature to a third party. You've assuredly gone through the due diligence of asking them how they manage their own security and authentication, but it's still something that you don't control.

Facebook, one of the most valuable public companies in the world, recently reported a breach where they had to reset any "log in with Facebook" authentications for millions of users. Github has roughly two orders of magnitude fewer employees than Facebook.

Anyway in case you have an internal feature request for U2F on "email" logins, please consider this an external "+1" for it.