If you set up a Windows Azure account and link it to Your Office 365, you may enable 2 Factor Authentification for all your administrators and…
its free for admins!!!!
This only affect admins when logging in using a MSOL ID, if you use Dirsync you have more options.
Start here: http://manage.azure.com
See the service running as Pay-As-You-Og (which you can change)
This Setup results in this Challenge on MSOL services:
Here is where you enable it in Azure:
You may also change Subscription type if you have MSDN