You set up two-step verification with an email address, phone number, or authenticator app. Even if someone else finds your password, they'll be stopped if they don't have access to your other devices or accounts. It uses two different forms of identity: your password, and a contact method.
Two-step verification helps protect you by making it more difficult for someone else to sign in to your email account. If you are migrating your or account to Microsoft 365 or Office 365, you'll need to enable two-step verification (also known as two-factor authentication).