> Users would login with their Okta creds and a push would silently go to their devices. If they didn't know to check their phone it would just fail to login. Alternatively you can paste your TOTP code after your password. Yes, really.

This sounds exactly like my Cisco (anyconnect) VPN experience from a previous job/life, both before and after Okta was introduced... we think it don't be like it is, but it do.