A suggestion, hopefully helpful: a better approach to securing your admin console than simply layering 2FA onto it would be to expose it to a private WireGuard network. One very easy way to do that is with Tailscale, which will hook up to your GSuite authentication --- Google's 2FA stack will be far better than anything you'd likely build on your own.
Tailscale is disgustingly simple to set up. If you're a product person, it's actually upsetting how easy they've made it to get set up.
I setup Tailscale for my home server the other day, can vouch for how disgusting it is. I thought it would take at least an hour, but no, took about 5 minutes. Was, literally, physically taken aback (in a good way). Highly recommend it.
A suggestion, hopefully helpful: a better approach to securing your admin console than simply layering 2FA onto it would be to expose it to a private WireGuard network. One very easy way to do that is with Tailscale, which will hook up to your GSuite authentication --- Google's 2FA stack will be far better than anything you'd likely build on your own.
Tailscale is disgustingly simple to set up. If you're a product person, it's actually upsetting how easy they've made it to get set up.