This means that the user MUST set up 2FA, otherwise he cannot log in completely. is there any option?