It would be nice to have the option to force 2FA enrollment for all users, or by user group.