"MFA requires the corporate IdP" is a strange rule for the system that has to keep working when everything else is down. goca's second factor is offline TOTP — the QR code is built in-process, and an authenticator generates codes with no network and no identity provider.
It is also mandatory for local system administrators, and the floor is compiled into the server: a forged database row that tries to drop it fails closed. Locked out with no colleague to reset you? Break-glass is a k-of-n set of Shamir cards, redeemable only with the identity's password plus k cards — a stolen card set alone authorizes nothing.
You'll enroll, and generate your own card set, in Users, MFA & Multi-Person Control.