Implement MFA configuration during Enrollment process

[teon]

https://www.figma.com/file/uoFcgpOuVWa6g7tvKwB52o/defguard-01?type=design&node-id=2138-5395&mode=design&t=dheb1uhAXs2Fw8T8-0

[ComputerNerd100]

Just discovered this issue exists when reading through before raising the same thing, would be keen to know if there's any updates on this @teon ?

This at the moment has caused a "chicken and egg" issue for us where we've had to disable the MFA requirement on a location during a user onboarding and then reenable it afterwards.

But the ability for the user to setup their MFA methods during enrollment would be amazing.

I also wonder if, depending on the scale of configuration MFA during enrollment, a short-term solution could be to add support for an admin-issued one time token, or for admins to toggle an MFA bypass for a new user, allowing them to connect once without their own MFA enabled, access the defguard console, setup MFA and then reconnect that way?

This could have the side benefit of providing a nice way for users who have lost an MFA method to be able to reconnect to the VPN and reset their MFA details by using an admin-triggered process.