Two-factor authentication
The single most useful thing you can do for this account.
A password can be reused, guessed or phished. A second factor makes all three much less useful to whoever obtains it.
Setting it up
Profile → Two-factor authentication. Scan the code with any authenticator app, then enter a code to confirm. It is not enabled until you have proved the app works — so a mis-scan cannot lock you out.
Recovery codes
You get a set of one-time codes when you enable it. Save them somewhere that is not the phone with the authenticator on it. Each works once.
If you lose both the phone and the codes, a workspace owner cannot help — we cannot turn off two-factor for you, because an account recovery path that support can trigger is a path an attacker can talk support into triggering.
Why the workspace might require it
Owners can require two-factor for everyone. If you see a prompt you did not expect, that is why.