One account per assigned identifier. Invite someone to give them a one-time setup link: they choose their own password and set up an authenticator. Only IT can see this page.