Separate names with a comma.
I really second this. As a Service Provider, the inability to filter on client public IP poses a security threat to us as we need to disable 2FA...
