Depends on D18791. Ref T13024. This clears up another initialization order issue, where an unverified address could prevent MFA enrollment.

Configured both verification required and MFA required, clicked "Add Factor", got a dialog for the workflow.