A new security setting adds multi-factor authentication to Fulcrum. Head to Business Setup > System Data > Security and turn on Require Multi-Factor Authentication. Once it's on, anyone signing in with email and password gets walked through MFA setup the first time, then enters a one-time code on every login after.
Codes come from any standard authenticator app—Google Authenticator, Authy, Microsoft Authenticator, or any TOTP app—so there's no extra hardware or texts to manage. It's off by default, doesn't affect SSO, and admins can reset a user's MFA if they ever lose access to their authenticator.