I'm about to enforce 2 factor authentication for all g suite accounts - what happens if I enforce it and some users didn't enable it for their accounts yet? Will they be unable to log in or do they get a prompt on their next login to set up 2FA?
Yes, users won't be able to log in if they don't have 2FA enabled when you enforce it. This is covered at the top of the article for 2FA enforcement:
Before enforcing 2-Step Verification, make sure all of your users and administrators are enrolled in 2-Step Verification. You can place users not yet enrolled in 2-Step Verification into exception groups so they will not be locked out of their Google accounts when you enable 2-Step Verification enforcement.
I know this has been answered, but I just went through this today.
Several users had failed to Set-Up 2FA before the date it was enforced. Those users were directed to contact their administrator.
When looking at the user account in Google Admin Console in the Security Section, you can check their enrolement with 2FA and also "View Backup Codes". This seems to generate some back-up codes that previously had not been generated (because they didn't turn on 2FA themselves).
Once the back-up codes are generated, when the user tries to login, they are prompted to either contact their administrator or provide a back-up code. You can provide one of these back-up codes (securely of course) to get them signed in, then they should be able to enrole themselves with 2FA.
This bypasses the need to create this exception group and the very human possibility of accidentally forgetting the exception group and leaving one or more accounts in a reduced security situation.
Hope this helps.