Once enabling for my account I would use a 2nd factor every time I log in, including on websites and for terminal access. My Single-Sign-On session would remain valid for 12 hours, meaning that I would only need to log in with 2FA infrequently for website access.