Open Admin › Security and access › Two-step verification, switch it on and choose the methods: an authenticator app (Google Authenticator, Microsoft Authenticator and others) and/or a code sent by email.
Then choose who must use it: nobody (optional for everyone), staff and admins only, or everyone. Each person sets it up under Two-step verification in their account and receives one-time recovery codes for when the phone is not at hand.