diff --git a/src/translation/en.json b/src/translation/en.json
index 462d35a31..113673a7e 100644
--- a/src/translation/en.json
+++ b/src/translation/en.json
@@ -197,7 +197,8 @@
             "require2FACheckbox": "Require users to set up 2FA",
             "subscriptionRequired": "These features are only available in the paid plans.",
             "subscriptionRequiredAction": "Set up Subscription Now",
-            "saveAction": "Save"
+            "saveAction": "Save",
+            "require2FAWarning": "Setup 2FA for your account first to avoid getting locked out."
         },
         "externalLdap": {
             "title": "Connect an External Directory",
diff --git a/src/views/users.js b/src/views/users.js
index f584f89bc..e6166eba5 100644
--- a/src/views/users.js
+++ b/src/views/users.js
@@ -856,6 +856,9 @@ angular.module('Application').controller('UsersController', ['$scope', '$locatio
         },
 
         submit: function () {
+            // prevent the current user from getting locked out
+            if ($scope.profileConfig.mandatory2FA && !$scope.userImport.twoFactorAuthenticationEnabled) return Client.notify('', $translate.instant('users.settings.require2FAWarning'), true, 'error', '#/profile');
+
             $scope.profileConfig.error = '';
             $scope.profileConfig.busy = true;
             $scope.profileConfig.success = false;