A second factor at login on top of the password — a one-time TOTP code from an authenticator app. A user enables MFA from the "Security" card in their profile; entry to setup is protected by re-entering the password. A three-step wizard connects the second factor, after which two-factor authentication is active and managed on the same screen.