Device passwords
The English version governs if the two differ.
Why you need one
Calendar, contact and drive clients send a password on every request and have nowhere to type a two-factor code. Rather than let your account password through a path that skips two-factor, each device gets its own password. It can be revoked on its own and cannot sign in to the website.
Making one
Sign in to Cloud Office, open Settings, then Security. Under Device passwords, give the device a name you will recognise later — “iPhone”, “work laptop” — and press Create.
The password is shown once and never again, because only a hash of it is kept. Copy it before you close the box. If you lose it, revoke that one and make another.