I created 2 Entra Apps for External users (CIAM). I am using one of them to create users in and the other one for the app users to login. Both apps support multi-tenants and personal Microsoft accounts to access their API. I want to limit the user creations to using API (for more security) and I want enable 2FA using sms during login for all users who will create account using the API. The users login to other Entra app using Microsoft pop up userflow and I want to enable 2FA (sms) here that will be handled/executed by the CIAM (the Entra App). Is this kind of setting possible?