We should add the option to require 2FA configuration at first login for staff users when 2FA is enabled on the system.