Every Add25 staff account needs a second factor before it can sign in. A staff session can see every donor in the network, which is why this is not optional and not something to come back to later.
Checked again here, and again when you confirm. Adding a second factor is the moment a stolen session would become a stolen account.