Installs want a way to require users configure MFA. Roughly:
- A per-account "this account must always have MFA" flag. This locks the account down so only MFA enrollment may be performed, and prevents removal of the last remaining MFA factor.
- Tools for setting the flag (CLI + Web) and removing the flag (CLI).
- A CLI tool for reviewing enrollment status (users, flag-or-not, enrolled-or-not).
- And probably a global config setting for "all users must enroll".