A colleague or developer who used to sign in to your website suddenly cannot get in, and it can look like a block based on their country or location.
Why this happens. The secure login setup on your site does not filter by country, region, or IP address. It does two things only. It moves the login page to a private address, so the standard /wp-login.php and /wp-admin addresses return "Not Found". It also requires a 6-digit code from an authenticator app on top of the password. Neither of these checks where someone is connecting from, so a login that works in one country works in every other one.
The usual cause is that the person never had an account of their own and was signing in with someone else’s credentials. That works until the browser session expires. After it expires, getting back in needs both the password and the rotating 6-digit code, and the code lives on whichever single phone was used to set it up. Anyone who does not have that phone is locked out.
What you can do. Give each person their own login. Send support the full name and email address for anyone who needs access. Support creates an account for each of them and sends each person their own password through a one-time link, along with the steps to set up their own 6-digit code.