A six-digit code from an authenticator app on your phone — Microsoft
Authenticator, Google Authenticator, 1Password, Bitwarden — as well as
your password. It does not travel and does not depend on your mailbox,
which matters because your email address is also how a password reset
reaches you.
You can do this later under Security. Skipping is fine — we will ask again in a few days, and stop for good once it is on.