First off, this may not be the right community. If it's not, I apologize and please close this and point me in the right direction.
Apple will start enforcing two-factor authentication for its developer accounts in February and we are trying to figure out how to best handle this.
We are currently a small team (fewer than 10 devs) and our clients will grant access to a single account we own. We will then login to that central account so we can access our apps in the clients' accounts. We currently have access to about 20 accounts. Now, I realize this is a poor security practice as you can't track who is actually accessing the account and making changes but we've stuck with it for the sake of flexibility.
We don't believe it feasible to ask a client to grant access to every single dev who needs access (most of the time, we have to sit on a screenshare with them just so they can figure out how...), nor does it seem possible for them to grant our central account access and then for our central account to grant our individual devs access. Additionally, when a dev leaves, we would then have to contact each client and ask that they remove access for that user (likely meaning we have to screenshare again; it could also be burdensome for the clients if we go through a period of high turnover or hiring).
With the introduction of the 2FA requirement, we need to determine how to change things going forward. The way I see it, we either have to go the extremely difficult route and grant each user access, stick to using the central account and share the 2FA codes as they are needed (meaning the primary user, likely me, would have to be available at all times...), or we'd have to only allow a single user to manage all Apple Apps (likely not feasible).
Is there an accept best practice or community standard we are overlooking for this so we can both improve our security and allow our devs to continue working as freely as they have been in the past? Am I overlooking some option that would allow us to grant access to our central account which then is granted access to client apps?