we need the ability to force Two-Factor for all users and a report to verify compliance.