Alias-first. MFA required.
Authentication is alias-first. Lost access? Use a recovery code on the next step.