So my boss just came to me and told me that certain vendors we are using, that we have direct site2site, and one or two that over the internet allow our IP.

Issue is that our cyber insurance is now saying they may require for some of the more secure services we use that we implement MFA. (when we don't even host the stie.) so my bos wants to know if we can do this via paloalto?

He sent me a link:

Building Blocks of an Authentication Policy Rule (paloaltonetworks.com)

But internal users are already logged into AD, and authentication's happened. And the mfa he wants is another layer..

One idea in my head is to make a portal page, facing the inside.. and host it in that? I'm not even sure it'd work depending on the access they need..