I am the admin of a Google Apps domain. I created a brand new user account. I tried to sign in as that user (in a new browser) and it told me that "Your organization's policy requires you to enroll in 2-step verification. Please contact your administrator for more information." And then prompts me for a code.
How on earth would this brand new user have a code if they have never logged in before?Furthermore, when I look at this users account info from the domain admin panel, it says that 2FA is turned OFF.
Clearly when I try to login as this user it is not off since it's prompting for a code. There seems to be no way to access brand new accounts since it's requireing 2FA codes, but you can't get 2FA codes until you can login to the users account and turn it on & set it up!