Two-factor auth is controlled from Config Hub > Security.

• admin protection
• staged enforcement
• stronger account security on higher-risk installs

Security now treats 2FA as its own save area inside the Security section.

That means:

• Enable 2FA turns the feature on for the install
• Enforcement Start Date lets you stage when users without 2FA must enroll
• the 2FA controls are saved separately from the Identity & VPN controls

• enable it in a controlled rollout
• test recovery and enforcement dates before forcing it widely
• make sure your email and support paths are ready before aggressive rollout
• verify SMTP before relying on 2FA-related email workflows