Drupal automatic TFA
There is currently no mechanism to require existing users to use TFA; if you use "authenticated user" with "Roles required to have set up TFA", then new users cannot set up TFA and existing users without TFA will not be able to log in.



TFA doesn't provide any mechanism for this, so I wrote a module that provides Rules integration and created a basic rule that would do it.

https://www.drupal.org/project/tfa_rules

Instructions on setting up basic TFA on a site:

Download and install Two-Factor Authentication, TFA Basic Plugins, Rules and TFA Rules

drush dl tfa tfa_basic rules tfa_rules


Enable.

drush -y en tfa tfa_basic rules rules_admin tfa_rules


Configure TFA: /admin/config/people/tfa


[X] Enable TFA
Default validation plugin: TOTP
[Save configuration]


Configure permissions: /admin/people/permissions


Set up TFA for account


[X] authenticated user

[Save permissions]


Visit /admin/config/workflow/rules to configure the rule.

Testing:


Log out
Create a user
Login
User will be redirected to the security page to set up TFA.