Ametys 4.6 offers enhanced authentication.
When this is set up, a unique code is required to connect to the back office:

or to connect to the front office :

The user can choose how the unique code is received (via a back-office tool or a front-office service):

Enhanced authentication is not available in safe mode, nor if the user does not have mail.