I'm about to enforce 2 factor authentication for all g suite accounts - what happens if I enforce it and some users didn't enable it for their accounts yet? Will they be unable to log in or do they get a prompt on their next login to set up 2FA?
Yes, users won't be able to log in if they don't have 2FA enabled when you enforce it. This is covered at the top of the article for 2FA enforcement:
Before enforcing 2-Step Verification, make sure all of your users and administrators are enrolled in 2-Step Verification. You can place users not yet enrolled in 2-Step Verification into exception groups so they will not be locked out of their Google accounts when you enable 2-Step Verification enforcement.
