Two-factor protects the accounts that can refund money and read every client record. It takes ten minutes; plan how a lost phone is recovered first.
- Enable a method
Settings › Two-Factor Authentication. An authenticator app (time-based codes) needs no outside service; Duo and YubiKey are also available.
- Enroll yourself first
Scan the code, confirm a code, and save the backup codes somewhere that is not that phone.
- Sign out and back in
Prove it works before anyone depends on it.
- Enroll a second full administrator
And confirm they can sign in on their own.
- Make it required
Optional means the account that matters most is the one that skipped it.
Locked out?
Use a backup code. Otherwise another full administrator switches two-factor off on the account, and the person re-enrolls at once.
Clients can use it too
Client two-factor is a separate setting. Allow it, and clients switch it on for their own account in the portal's security settings.
Full guide
The complete reference is Turn on two-factor authentication in the WBAMS documentation.