Two-factor authentication (2FA) adds a second step at sign-in -- a one-time code -- so a password alone is not enough to get in.
2FA is recommended for all accounts and may be required for staff, administrators and tutors who handle student data.
Where enabled, a one-time code is sent by email or generated by an authenticator app. [Adapt to the methods you support.]
If you lose access to your second factor, recovery is possible after identity checks. Keep any backup codes safe.