Require two-step sign-in for a person

You can require two-step sign-in for a specific person in your workspace. The requirement is yours to set and the person cannot lift it.

Require it

Open Settings → Users and find the person.
Turn on the requirement for them.

Only an administrator can.

What the person then needs

Entering your workspace needs a session that passed the second factor, or a passkey sign-in:

They already use an authenticator app. They sign in as before and enter the 6-digit code.
They sign in with a passkey. A passkey is already two factors, so nothing more is asked.
They have no authenticator app. They set one up first, in Sign-in and security on their account page. See Set up two-step sign-in.

While the requirement is on, the person cannot switch two-step sign-in off themselves.

It is recorded

Your decision is recorded in the change journal, so you can see who required it for whom, and when. See See who changed what.