Is there a way to force TOTP validation with "set up later by user" checked by default for all new end users?

Hello,

Sure it is possible to force TOTP for accounts to not have to manually enable the Set up later by user option.

The Default 2FA must be set to TOTP in Administration - Server Settings - Two-Factor if multiple 2FA are enabled.



All rules must be properly set in Administration - Server Settings - Security Policies.

On that screen capture, I have set the 2FA policy default action to 2FA Required if none of the policies below match.



I have also created a policy, Skip Admin 2FA, to prevent being prompted for 2FA for DVLS administrator accounts.



So when I connect with a DVLS administrator account, I don't get any 2FA prompt. But when I connect with any other account types or DVLS non administrator account, I get the following prompt on login attempt if the TOTP isn't configured yet.



Let me know if that helps.

Best regards,

This is perfect, thank you so much.