Power Platform Service accounts tied to one account

should move towards service principal, not a user acct but a Azure AD app identity. To consider whether this even need to be interactive acct since it is stated service acct, it should not. in any case, there is the 

Change the MFA authn from MS Authn to Bitwarden MFA (TOTP) for interactive acct.

It is more of changing the authn from MS authn to Bitwarden TOTP here. 

And subsequently to remove the MS Authn for those users of concern.

Change into service principal access via Bitwarden organisation, which I am thinking of the steps:
1. Set up service principal thru app registration for bitwarden, in this case is directory connector here
2. Set up CA policy to allow access to (1) to access power platform here
3. In (2), on CA to enforce the need for MFA for the right bitwarden user group 

The stretch is even to have Bitwarden via SCIM to be in sync with ability to make changes to Azure AD too.  Azure AD SCIM Integration