I did some research to find a way to validate that external users (outside the GCP organization) have multi-factor authentication enabled. I found Google Workspace [is_2sv_e