I have a D7 site in which I've setup TFA using TOTP. If TFA is not required, the user can login with their user/pwd, visit the profile page, click the security tab, and setup TFA.
However, if TFA is required for their role, the only way they can setup TFA is to have an admin access their user profile and supply them the code to enter into their auth app, then wait for them to provide the code to enter into the user profile. That is tedious and cumbersome.
Most TFA tools allow the user to initially login to their account and then redirects them to where they can setup TFA themselves.
Am I missing something? Is there a better workflow available? We want to enforce TFA, but don't want to have to manually administer setup for all users.