(in fact, personally, I think that Google's token system might be far easier)
In any case, as it turns out, we can't login to PowerShell now that MFA is running.
A little searching provided the answer. We had to install an extension for PowerShell. The process is already very well documented, so I won't go over here except to add one observation;
- You must install it via Edge (or possibly IE) -- it won't install via Chrome.