PUBLIC
An authenticator app, so a stolen mailbox is not a stolen account.
Operations and administrator accounts need a second factor to sign in. Set one up here.
Any authenticator app works — 1Password, Authy, Google Authenticator, or whatever your team already uses.