Is there a way to enforce 2FA?

This means that the user MUST set up 2FA, otherwise he cannot log in completely.
is there any option?