Restricted. Every sign-in is emailed to the admin.
Next you'll enter the code from your authenticator app.