You can setup the authentication settings however you like. For example: You can setup two-step login for Administrators and one-step login for the rest so that you can provide one extra layer of protection to Administrator accounts. It's up to you. We suggest you watch the Videos displayed on the settings page to understand more about one-step and two-step login methods. Then, discuss your security needs with your team and decide on these settings. They can be changed at anytime by the WordPress site administrator.