Protect staff sign-in with Google Authenticator, 1Password, Authy, or any TOTP app. You can skip and enable later from Staff IAM.
Scan the QR, or enter the secret manually. Then type the 6-digit code to confirm.