A cloud security auditor flags that several administrators can log in to the provider's management console using only a username and password. Company policy and a new compliance requirement mandate stronger protection specifically for privileged, interactive human logins to the console, without disrupting automated service-to-service API calls that use short-lived tokens. Which control should the cloud administrator implement first to address the finding?