Is it possible to enable 2 factor authentication or prompt for password(root) when deleting any azure resource?

This is the first time I'm dealing with access management in azure so, please don't mind the noob questions. I need info for following points,

1. When deleting any resource (web app, resource group, app service plan, etc) is there a way to add an additional security that will restrict current user from deleting any resource without providing 2nd authentication?
2. Can I revoke a user's create, modify and delete permissions without affecting the  deployed resources?
3. Can I add password/pin locks when the user tries to delete a resource?

Thanks!