Needs the admin password and the one-time enrollment code from the server.
Scan this with your authenticator app, then enter the 6-digit code it shows.