See attached guide to setting up 2-factor authentication via Google or Microsoft. The Client will need to have the app of choice downloaded on their phone.
To enable this for an employee they have to do so individually. Below is a screenshot of the setting that will need to be enabled. I recommend they try this out on themselves or a test employee before rolling it out to everyone else.
Let me know if there are any questions.
Thanks,
Garrett