Two-factor adds an authenticator app code on top of whichever method you sign in with. It is off by default and not required.
Whether you need it
Think about what it adds on top of what you already have.
On a one-time email code, it adds a real second factor: somebody with your mailbox alone cannot get in.
On a passkey, it adds much less. A passkey is already something you have plus something you are, and it cannot be phished. Turning on two-factor here mostly adds friction.
With SAML single sign-on, do it at the identity provider instead. That is the whole point of SSO: one policy, applied everywhere, rather than per application.
So the honest answer is that it earns its place for organizations with a policy requiring it, and for anyone whose main route in is an email code.
Setting it up
From your account settings, under Security, in the two-factor section. Scan the QR code with your authenticator app, enter the code it generates, and save.
You are then given backup codes. Store them somewhere that is not the phone holding the authenticator, because the situation they exist for is that phone being lost.
Signing in with it
Your usual method, then the code from the app. A backup code goes in the same field.
Turning it off
Disabling asks for a code emailed to you and a code from the authenticator. Both, deliberately: turning off a second factor should be at least as hard as using it.
If you lose the authenticator
Use a backup code, sign in, and set it up again on the new device.
With no backup codes and no authenticator, this becomes an account recovery matter. See Support PIN and account recovery.