Its good to have the option to only login in from IP-addresses, but would be a lot more powerful if only allowing login from certain MAC-addresses. This way it has to be your machine you are login into.

Once the admin selects this feature in the admin portal, the change has to be approved with a MFA prompt. So the admin has to have MFA setup before moving on to the MAC-address option. When the approval is granted the MAC-address from the admin computer is automatically added as a approved MAC-address, so not to lock out the admin from the system.