I use duosecurity. It is an amazing app And its free to try out for a few devices/users. THere is an integration guide on their website for Palo Alto Networks. The guide goes over integration for GlobalProtect, but you can use that same methodology for admin access.
... View more