How to activate recovery for existing users

See KlausBecker’s comment here Lost user-password, DELETE user and make new one

Short answer: Existing users need to enroll. If it’s turned on new users will auto-enroll.