If you set up a Windows Azure account and link it to Your Office 365, you may enable 2 Factor Authentification for all your administrators and…

its free for admins!!!!

This only affect admins when logging in using a MSOL ID, if you use Dirsync you have more options.

Start here: http://manage.azure.com
See the service running as Pay-As-You-Og (which you can change)

domains

This Setup results in this Challenge on MSOL services:

Other Alternatives
Other Alternatives

Here is where you enable it in Azure:

WAAD

manage WAAD

You may also change Subscription type if you have MSDN

pay as u go
msdn sup