“Cool, but... I couldn't find any info on the full implementation of 2-factor auth (i.e. full support in the client apps without app passwords), what happened to those?”
“Paul, you've mentioned "federated on-premises directory", but that's not a complete answer. We're using our on-premises Active Directory domain and Office 365 with DirSync due to the much decreased maintenace and setup efforts it takes. We're very-very happy with it, so we definitely aren't planning to switch to a federation scenario.
So I'm all curious whether you're planning to support that as well or not. Please, tell me that you are :)”