Internal, operator-facing. Every action here is written to an audit log the tenant can also see.
Every operator account requires an authenticator app. The next step asks for a code.