Authorised staff only.
Required before the console unlocks. In Google Authenticator / Microsoft Authenticator / Authy choose Add account → Enter a setup key and type this key (time-based):
Or on the phone, open: otpauth link