Hi Charles,
Illumio supports SAML-based Single Sign-on. We have tested SSO with OneLogin, Okta, Ping, and Active Directory Federation Services (ADFS) and a lot of our customers use those Identity Providers (IdP). Once the PCE is integrated with your IdP, you can easily turn on 2FA and password expiration/change policies on your IdP. Hope this helps!
Thanks
Mukesh