A company wants employees to authenticate to a cloud application with its corporate identity provider and a second factor. Which combination fits?

1. A shared application password and anonymous guest access
2. A network allowlist with password checks disabled
3. Federated sign-in and an enforced multifactor authentication policy
4. Local administrator accounts without lifecycle integration