You have the option to select just one, two, or all three of these options. 

Enable Two-factor Authentication - Turns T-fa on and you will need to scan a QR code on your mobile or enter a code from the Authentication app on your mobile. 

Force Two-factor Authentication - All employees logging in will be forced to use a Two Factor authenticator code.

HR Managers manually submit data to Payroll - Stops the data auto hitting payroll and time attendance, and lets the HR manager click the button after they've taken a look to then push it through to payroll and time attendance.