Some of the most common infosec advice in 2025 is to enable multi-factor authentication for user accounts.
This is currently not possible for AGOL organisations with a single user or a single admin user.
As people and companies are expected to follow the best available advice when formulating their security strategies, the current Esri position to not have this feature makes no sense. This also makes it hard to justify the use of AGOL with some potential customers.
Please create a no-cost license category that only has the capability to be used as the second admin account for MFA purposes.
My assumption is that Esri does not want to be saddled with support cases where users lock themselves out of their accounts - but that has been a solved problem for Google, Meta, Microsoft, Proton, LinkedIn, X, Amazon + AWS, LastPass (they've got other issues....), 1Password, Bitwarden, DropBox, Steam, PayPal, Ubiquiti, Github and many, many, many, many more.
Following the recent discovery of and media commentary on a compromised ArcGIS Server, the advice from a cyber recovery consultancy, and echo'd by many is:
(yes - I know AGOL != ArcGIS Server and identity management is different; this case just reinforces and highlights what we lack in AGOL)
If the formal Esri position is that, if you want to have contemporary security in your small AGOL org, you shall buy two Creator licenses for one user, it must be clearly stated in the documentation and product pages.
