* Always allow the mandatory 2fa setting to be saved * Show warning for user if they have no 2fa setup and if not external 2fa * If they get locked out anyway, they have to use CLI tool * redirect for mandatory 2fa only if not external 2fa as well