Admins must have two-factor authentication enabled.