An administrator approves new accounts and chooses the role
After approval, sign in and set up two-factor authentication.