[acanby]

One problem I have with the current 2FA on Google Apps is that there is no way to enforce 2FA for all users before everyone sets up their mobile device. If you've set the requirement for all to have 2FA, then new users can never log in.

You're then left in this limbo of some with/some without 2FA, and unless you actively pursue those without it setup, you can never change that system wide setting in the control panel.

[jim-greer]

This is a serious problem, but they do have a workaround. You put new users in an "exception group" that doesn't require two factor auth. Then after they set them up you take them out of the group. It's better than nothing:

http://support.google.com/a/bin/answer.py?hl=en&answer=2...