Open Settings → Security.
Scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password, and the like), or type the manual key, then confirm the 6-digit code.
You can enroll more than one authenticator and remove any of them later. Changes ask for your password or an existing code.