Yes, we ended up going with Okta (okta.com) for authentication which supports MFA. On the IIS web server used for QlikView I setup shibboleth as a service provider with a SAML2 interface with Okta. Basically, shibboleth protects all of the QV folders and requires Okta authentication in order to access QV. In Okta, each user is assigned to a group which gets passed to QV via the SAML2 interface, this is what we use to allow access or not. Okta engineers helped us get this setup.