403 forbidden error when grant admin privilege to a user

[Rick_Jing]

I’m not sure these are all settings for 2-factor auth, I enabled for staff before and I still have to input the code to sign-in, but I think I set it back to default earlier.
should I disable the first one?