You can configure NetIQ AA service to provide MFA authentication for any Retain users with a Retain User Account.
To set this up, follow the instructions in Configuring Retain for NetIQ Advanced Authentication MFA Support
in the Retain 4.10: Configuration and Administration guide.