Required once you have enrolled an authenticator.
Staff accounts are created from the CLI. There is no sign-up.