While it is true that there is no direct support for 2FA (Duo) in Splunk Cloud anymore (it was removed after 6.6 I believe), the way to still achieve 2FA is to do it at the SAML/IDP layer. As long as your IDP supports 2FA and the 2FA bits happen outside of Splunk, go for it.
Duo IDP is not supported in in Cloud b/c it cuts off local users needed for administration in Splunk Cloud. If DUO re-writes its IDP in the future it maybe possible.
Can Splunk please confirm that this is still a valid answer? My Splunk Cloud ver 7.2 does not appear to have any options for configuring Duo support.
This page https://docs.splunk.com/Documentation/Splunk/8.0.0/Security/AboutMultiFactorAuth clearly states
"Splunk Cloud does not support
multifactor authentication with Duo
which is a contradiction to this accepted answer.
If Duo is supported in Cloud 7.x/8.x please point us to the appropriate documentation.