Employee and client accounts both require Owner activation before they can sign in.
After activation, accounts that require two-step verification will be guided through authenticator-app setup on first sign-in.