Required. From your authenticator app - ask an administrator to enroll you if you have not set one up.