The first sign-in uses the setup code from the server data directory and creates the administrator. After that, an authenticator is required unless the client address is on the MFA allow list.