With accepting the fact that there is no built in Multi Factor Authentication, it disappointed us that there is a very weak, basically no password policy. even “12345678”, or “password” are allowed as password 
For a tool which is not MFA capable, please create a password policy which is compliant with best practices, or give the Admins the option to create their own password policy. It is also advised to create al password blacklist to block people give such easy passwords as 12345678 for their accounts. It would be also helpful for you to gain customers who needs to comply with regulations and standards...
