docs.microsoft.com/en-us/azure/ac… is maybe interesting for only using two digits, albeit the interaction model is the inverse of typical SMS 2FA