Step 1 of 2. Enter your username and password to reveal the QR code, scan it with any authenticator app (Apple Passwords, Google Authenticator, 1Password), then sign in with password + code. Lock enrollment from ACCOUNT when it works.