Even with this activated it’s not stopping spam orders.
The list of users are all showing as Deactivated even though I’ve clicked activate All Users.
Well that is weird. Just for the heck of it, I deleted the account from Microsoft Authenticator and added it to Google Authenticator and it then worked.